Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
- CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ca1d5275-3398-47a7-889b-4050ebe635ee?source=cve - https://plugins.trac.wordpress.org/browser/wp-job-portal/tags/2.1.5/includes/formhandler.php - https://plugins.trac.wordpress.org/browser/wp-job-portal/tags/2.1.5/includes/includer.php - https://plugins.trac.wordpress.org/browser/wp-job-portal/tags/2.1.5/includes/wpjobportal-hooks.php - https://plugins.trac.wordpress.org/browser/wp-job-portal/tags/2.1.5/modules/configuration/controller.php - https://plugins.trac.wordpress.org/browser/wp-job-portal/tags/2.1.5/modules/user/controller.php - https://plugins.trac.wordpress.org/browser/wp-job-portal/ta
owser/wp-job-portal/tags/2.1.5/modules/user/controller.php - https://plugins.trac.wordpress.org/browser/wp-job-portal/tags/2.1.5/modules/user/tmpl/views/frontend/form-field.php - https://plugins.trac.wordpress.org/changeset/3138675/
CVE ID: CVE-2024-7954 State: PUBLISHED Published: 2024-08-23T17:43:20.967Z Last Updated: 2025-11-22T12:12:14.668Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: SPIP Products: SPIP Problem Types: CWE-95, CWE-1286 Description: The porte_plume plugin used by SPIP before 4.30-alpha2, 4.2.13, and 4.1.16 is vulnerable to an arbitrary code execution vulnerability. A remote and unauthenticated attacker can execute arbitrary PHP as the SPIP user by sending a crafted HTTP request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vulncheck.com/advisories/spip-porte-plume - https://blog.spip.net/Mise-a-jour-critique-de-securite-sortie-de-SPIP
ttps://vulncheck.com/advisories/spip-porte-plume - https://blog.spip.net/Mise-a-jour-critique-de-securite-sortie-de-SPIP-4-3-0-alpha2-SPIP-4-2-13-SPIP-4.html - https://thinkloveshare.com/hacking/spip_preauth_rce_2024_part_1_the_feather/
CVE ID: CVE-2024-7955 State: PUBLISHED Published: 2024-09-10T06:00:02.205Z Last Updated: 2024-09-10T15:04:36.519Z Vendors: Unknown Products: Starbox Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Starbox WordPress plugin before 3.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/cbfcbe57-553d-490a-b7f3-48aa0022f63d/
CVE ID: CVE-2024-7957 State: PUBLISHED Published: 2025-03-20T10:10:21.850Z Last Updated: 2025-03-20T18:22:39.123Z Severity: CRITICAL (CVSS 9.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) Vendors: danswer-ai Products: danswer-ai/danswer Problem Types: CWE-29 Description: An arbitrary file overwrite vulnerability exists in the ZulipConnector of danswer-ai/danswer, affecting the latest version. The vulnerability arises from the load_credentials method, where user-controlled input for realm_name and zuliprc_content is used to construct file paths and write file contents. This allows attackers to overwrite or create arbitrary files if a zuliprc- directory already exists in the temporary directo
allows attackers to overwrite or create arbitrary files if a zuliprc- directory already exists in the temporary directory. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/21e9b909-036c-4544-ad35-6a5117836275
CVE ID: CVE-2024-7958 State: REJECTED Published: N/A Last Updated: 2024-08-19T19:14:59.090Z Description: No description available.
CVE ID: CVE-2024-7959 State: PUBLISHED Published: 2025-03-20T10:09:00.331Z Last Updated: 2025-03-20T18:59:33.926Z Severity: HIGH (CVSS 7.7 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: open-webui Products: open-webui/open-webui Problem Types: CWE-918 Description: The `/openai/models` endpoint in open-webui/open-webui version 0.3.8 is vulnerable to Server-Side Request Forgery (SSRF). An attacker can change the OpenAI URL to any URL without checks, causing the endpoint to send a request to the specified URL and return the output. This vulnerability allows the attacker to access internal services and potentially gain command execution by accessing instance secrets. Additional Analyst N
r to access internal services and potentially gain command execution by accessing instance secrets. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/3c8bea0a-d678-4d67-bb9c-2b5b610a2193
CVE ID: CVE-2024-7960 State: PUBLISHED Published: 2024-09-12T20:15:09.946Z Last Updated: 2024-09-12T20:49:51.544Z Vendors: Rockwell Automation Products: Pavilion8® Problem Types: CWE-269 Description: The Rockwell Automation affected product contains a vulnerability that allows a threat actor to view sensitive information and change settings. The vulnerability exists due to having an incorrect privilege matrix that allows users to have access to functions they should not. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1695.html
CVE ID: CVE-2024-7961 State: PUBLISHED Published: 2024-09-12T20:26:42.404Z Last Updated: 2024-09-12T20:48:32.542Z Vendors: Rockwell Automation Products: Pavilion8® Problem Types: CWE-22 Description: A path traversal vulnerability exists in the Rockwell Automation affected product. If exploited, the threat actor could upload arbitrary files to the server that could result in a remote code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1695.html
CVE ID: CVE-2024-7962 State: PUBLISHED Published: 2024-10-29T12:47:58.697Z Last Updated: 2024-10-29T13:38:20.986Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: gaizhenbiao Products: gaizhenbiao/chuanhuchatgpt Problem Types: CWE-29 Description: An arbitrary file read vulnerability exists in gaizhenbiao/chuanhuchatgpt version 20240628 due to insufficient validation when loading prompt template files. An attacker can read any file that matches specific criteria using an absolute path. The file must not have a .json extension and, except for the first line, every other line must contain commas. This vulnerability allows reading parts of format-compliant files, i
e first line, every other line must contain commas. This vulnerability allows reading parts of format-compliant files, including code and log files, which may contain highly sensitive information such as account credentials. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/83f0a8e1-490c-49e7-b334-02125ee0f1b1 - https://github.com/gaizhenbiao/chuanhuchatgpt/commit/2836fd1db3efcd5ede63c0e7fbbdf677730dbb51
CVE ID: CVE-2024-7963 State: PUBLISHED Published: 2024-10-09T02:01:16.854Z Last Updated: 2024-10-09T14:01:49.953Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: cmsmasters Products: CMSMasters Content Composer Problem Types: CWE-79 Description: The CMSMasters Content Composer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's multiple shortcodes in all versions up to, and including, 1.8.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute w
ticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/42c1d2ea-dea6-4cde-8db3-37709da9eb71?source=cve - http://cmsmasters.net/
CVE ID: CVE-2024-7964 State: PUBLISHED Published: 2024-08-21T20:20:23.072Z Last Updated: 2024-08-27T13:06:38.435Z Vendors: Google Products: Chrome Problem Types: CWE-416 Description: Use after free in Passwords in Google Chrome on Android prior to 128.0.6613.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2024/08/stable-channel-update-for-desktop_21.html - https://issues.chromium.org/issues/358296941
CVE ID: CVE-2024-7965 State: PUBLISHED Published: 2024-08-21T20:20:23.368Z Last Updated: 2025-10-21T22:55:47.040Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Inappropriate implementation in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2024/08/stable-channel-update-for-desktop_21.html - https://issues.chromium.org/issues/356196918
CVE ID: CVE-2024-7966 State: PUBLISHED Published: 2024-08-21T20:20:23.694Z Last Updated: 2024-08-27T13:05:22.672Z Vendors: Google Products: Chrome Problem Types: Out of bounds memory access Description: Out of bounds memory access in Skia in Google Chrome prior to 128.0.6613.84 allowed a remote attacker who had compromised the renderer process to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2024/08/stable-channel-update-for-desktop_21.html - https://issues.chromium.org/issues/355465305
CVE ID: CVE-2024-7967 State: PUBLISHED Published: 2024-08-21T20:20:23.973Z Last Updated: 2024-08-27T13:04:04.928Z Vendors: Google Products: Chrome Problem Types: CWE-122 Description: Heap buffer overflow in Fonts in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2024/08/stable-channel-update-for-desktop_21.html - https://issues.chromium.org/issues/355731798
CVE ID: CVE-2024-7968 State: PUBLISHED Published: 2024-08-21T20:20:24.177Z Last Updated: 2024-08-27T13:02:30.858Z Vendors: Google Products: Chrome Problem Types: CWE-416 Description: Use after free in Autofill in Google Chrome prior to 128.0.6613.84 allowed a remote attacker who had convinced the user to engage in specific UI interactions to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2024/08/stable-channel-update-for-desktop_21.html - https://issues.chromium.org/issues/349253666
CVE ID: CVE-2024-7969 State: PUBLISHED Published: 2024-08-21T20:20:24.411Z Last Updated: 2024-09-06T18:45:44.006Z Vendors: Google Products: Chrome Problem Types: CWE-843 Description: Type Confusion in V8 in Google Chrome prior to 128.0.6613.113 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://issues.chromium.org/issues/351865302 - https://chromereleases.googleblog.com/2024/08/stable-channel-update-for-desktop_28.html
CVE ID: CVE-2024-7970 State: PUBLISHED Published: 2024-09-03T22:40:26.584Z Last Updated: 2024-09-05T03:55:52.712Z Vendors: Google Products: Chrome Problem Types: CWE-787 Description: Out of bounds write in V8 in Google Chrome prior to 128.0.6613.119 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2024/09/stable-channel-update-for-desktop.html - https://issues.chromium.org/issues/358485426
CVE ID: CVE-2024-7971 State: PUBLISHED Published: 2024-08-21T20:20:24.778Z Last Updated: 2025-10-21T22:55:46.906Z Vendors: Google Products: Chrome Problem Types: CWE-843 Description: Type confusion in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://chromereleases.googleblog.com/2024/08/stable-channel-update-for-desktop_21.html - https://issues.chromium.org/issues/360700873
CVE ID: CVE-2024-7972 State: PUBLISHED Published: 2024-08-21T20:20:24.984Z Last Updated: 2024-08-22T15:05:12.215Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Inappropriate implementation in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: Medium) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2024/08/stable-channel-update-for-desktop_21.html - https://issues.chromium.org/issues/345960102
CVE ID: CVE-2024-7973 State: PUBLISHED Published: 2024-08-21T20:20:25.161Z Last Updated: 2024-10-24T19:40:16.594Z Vendors: Google Products: Chrome Problem Types: CWE-122 Description: Heap buffer overflow in PDFium in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to perform an out of bounds memory read via a crafted PDF file. (Chromium security severity: Medium) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2024/08/stable-channel-update-for-desktop_21.html - https://issues.chromium.org/issues/345518608
CVE ID: CVE-2024-7974 State: PUBLISHED Published: 2024-08-21T20:20:25.357Z Last Updated: 2025-03-19T16:07:59.496Z Vendors: Google Products: Chrome Problem Types: Insufficient data validation Description: Insufficient data validation in V8 API in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to potentially exploit heap corruption via a crafted Chrome Extension. (Chromium security severity: Medium) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2024/08/stable-channel-update-for-desktop_21.html - https://issues.chromium.org/issues/339141099
CVE ID: CVE-2024-7975 State: PUBLISHED Published: 2024-08-21T20:20:25.537Z Last Updated: 2025-03-25T16:10:42.745Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Inappropriate implementation in Permissions in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2024/08/stable-channel-update-for-desktop_21.html - https://issues.chromium.org/issues/347588491
CVE ID: CVE-2024-7976 State: PUBLISHED Published: 2024-08-21T20:20:25.768Z Last Updated: 2025-03-24T17:46:36.151Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Inappropriate implementation in FedCM in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2024/08/stable-channel-update-for-desktop_21.html - https://issues.chromium.org/issues/339654392
CVE ID: CVE-2024-7977 State: PUBLISHED Published: 2024-08-21T20:20:25.939Z Last Updated: 2024-08-22T19:41:49.104Z Vendors: Google Products: Chrome Problem Types: Insufficient data validation Description: Insufficient data validation in Installer in Google Chrome on Windows prior to 128.0.6613.84 allowed a local attacker to perform privilege escalation via a malicious file. (Chromium security severity: Medium) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2024/08/stable-channel-update-for-desktop_21.html - https://issues.chromium.org/issues/324770940
CVE ID: CVE-2024-7978 State: PUBLISHED Published: 2024-08-21T20:20:26.106Z Last Updated: 2024-10-29T19:53:20.368Z Vendors: Google Products: Chrome Problem Types: Insufficient policy enforcement Description: Insufficient policy enforcement in Data Transfer in Google Chrome prior to 128.0.6613.84 allowed a remote attacker who convinced a user to engage in specific UI gestures to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2024/08/stable-channel-update-for-desktop_21.html - https://issues.chromium.org/issues/40060358
CVE ID: CVE-2024-7979 State: PUBLISHED Published: 2024-08-21T20:20:26.309Z Last Updated: 2024-08-22T14:49:23.298Z Vendors: Google Products: Chrome Problem Types: Insufficient data validation Description: Insufficient data validation in Installer in Google Chrome on Windows prior to 128.0.6613.84 allowed a local attacker to perform privilege escalation via a crafted symbolic link. (Chromium security severity: Medium) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2024/08/stable-channel-update-for-desktop_21.html - https://issues.chromium.org/issues/356064205
CVE ID: CVE-2024-7980 State: PUBLISHED Published: 2024-08-21T20:20:26.474Z Last Updated: 2024-08-22T14:16:31.631Z Vendors: Google Products: Chrome Problem Types: Insufficient data validation Description: Insufficient data validation in Installer in Google Chrome on Windows prior to 128.0.6613.84 allowed a local attacker to perform privilege escalation via a crafted symbolic link. (Chromium security severity: Medium) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2024/08/stable-channel-update-for-desktop_21.html - https://issues.chromium.org/issues/356328460
CVE ID: CVE-2024-7981 State: PUBLISHED Published: 2024-08-21T20:20:26.687Z Last Updated: 2025-03-20T20:58:34.391Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Inappropriate implementation in Views in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2024/08/stable-channel-update-for-desktop_21.html - https://issues.chromium.org/issues/40067456
CVE ID: CVE-2024-7982 State: PUBLISHED Published: 2024-11-08T06:00:03.350Z Last Updated: 2024-11-08T14:36:17.779Z Vendors: Unknown Products: Registrations for the Events Calendar Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Registrations for the Events Calendar WordPress plugin before 2.12.4 does not sanitise and escape some parameters when accepting event registrations, which could allow unauthenticated users to perform Cross-Site Scripting attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/d79e1e9c-980d-4974-bfbd-d87d6e28d9a6/
CVE ID: CVE-2024-7983 State: PUBLISHED Published: 2025-03-20T10:10:35.664Z Last Updated: 2025-10-15T12:49:52.820Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: open-webui Products: open-webui/open-webui Problem Types: CWE-770 Description: In version 0.3.8 of open-webui, an endpoint for converting markdown to HTML is exposed without authentication. A maliciously crafted markdown payload can cause the server to spend excessive time converting it, leading to a denial of service. The server becomes unresponsive to other requests until the conversion is complete. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/f8156ca5-
rsion is complete. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/f8156ca5-1328-480f-a72b-8d3dfdad87dc
CVE ID: CVE-2024-7984 State: PUBLISHED Published: 2025-05-15T20:07:12.362Z Last Updated: 2025-05-17T03:26:08.392Z Vendors: Unknown Products: Joy Of Text Lite Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Joy Of Text Lite WordPress plugin through 2.3.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/07684ecb-5662-4412-8190-7957cfcf7bd3/
CVE ID: CVE-2024-7985 State: PUBLISHED Published: 2024-10-29T15:31:54.552Z Last Updated: 2024-10-29T20:00:30.951Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: softaculous Products: FileOrganizer – Manage WordPress and Website Files Problem Types: CWE-434 Description: The FileOrganizer – Manage WordPress and Website Files plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the "fileorganizer_ajax_handler" function in all versions up to, and including, 1.0.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, and permissions granted by an administrator, to upload arbitrar
cated attackers, with Subscriber-level access and above, and permissions granted by an administrator, to upload arbitrary files on the affected site's server which may make remote code execution possible. NOTE: The FileOrganizer Pro plugin must be installed and active to allow Subscriber+ users to upload files. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f79164c2-be3b-496d-b747-3e4b60b7fc2b?source=cve - https://plugins.trac.wordpress.org/browser/fileorganizer/trunk/main/ajax.php#L13 - https://plugins.trac.wordpress.org/changeset/3149878/
CVE ID: CVE-2024-7986 State: PUBLISHED Published: 2024-08-23T11:51:55.080Z Last Updated: 2024-08-28T16:21:02.832Z Vendors: Rockwell Automation Products: ThinManager® ThinServer™ Problem Types: CWE-732 Description: A vulnerability exists in the Rockwell Automation ThinManager® ThinServer that allows a threat actor to disclose sensitive information. A threat actor can exploit this vulnerability by abusing the ThinServer™ service to read arbitrary files by creating a junction that points to the target directory. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1692.html
CVE ID: CVE-2024-7987 State: PUBLISHED Published: 2024-08-26T14:40:29.255Z Last Updated: 2024-08-26T17:29:09.449Z Vendors: Rockwell Automation Products: ThinManager® ThinServer™ Problem Types: ThinManager® ThinServer™ Remote Code Execution Description: A remote code execution vulnerability exists in the Rockwell Automation ThinManager® ThinServer™ that allows a threat actor to execute arbitrary code with System privileges. To exploit this vulnerability and a threat actor must abuse the ThinServer™ service by creating a junction and use it to upload arbitrary files. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.rockwellautomation.com/en-us/trust-center/security-
al Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1692.html
CVE ID: CVE-2024-7988 State: PUBLISHED Published: 2024-08-26T14:47:07.612Z Last Updated: 2024-08-26T17:46:47.107Z Vendors: Rockwell Automation Products: ThinManager® ThinServer™ Problem Types: CWE-20 Description: A remote code execution vulnerability exists in the Rockwell Automation ThinManager® ThinServer™ that allows a threat actor to execute arbitrary code with System privileges. This vulnerability exists due to the lack of proper data input validation, which allows files to be overwritten. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1692.html