Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
source.com/platform/frameworks/base/+/a6321142ea43053ea8d0db516eede4c35c5dab18 - https://android.googlesource.com/platform/packages/providers/DownloadProvider/+/b2cc552f8e1ed982e6662f64baa2cdbf1acaf777 - https://source.android.com/security/bulletin/2025-03-01
CVE ID: CVE-2024-0033 State: PUBLISHED Published: 2024-02-16T00:08:16.586Z Last Updated: 2024-08-16T17:45:24.531Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In multiple functions of ashmem-dev.cpp, there is a possible missing seal due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/frameworks/native/+/aa98edf0ce9dde4886979658a459900ca987f193 - https://android.googlesource.com/platform/system/core/+
m/frameworks/native/+/aa98edf0ce9dde4886979658a459900ca987f193 - https://android.googlesource.com/platform/system/core/+/46d46dc46446f14f26fbe8fb102dd36c1dfc1229 - https://source.android.com/security/bulletin/2024-02-01
CVE ID: CVE-2024-0034 State: PUBLISHED Published: 2024-02-16T00:08:16.947Z Last Updated: 2025-03-19T18:00:14.471Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In BackgroundLaunchProcessController, there is a possible way to launch arbitrary activity from the background due to BAL Bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://android.googlesource.com/platform/frameworks/base/+/653f7b0d234693309dc86161af01831b64033fe6 - https://source.android.com/secur
.googlesource.com/platform/frameworks/base/+/653f7b0d234693309dc86161af01831b64033fe6 - https://source.android.com/security/bulletin/2024-02-01
CVE ID: CVE-2024-0035 State: PUBLISHED Published: 2024-02-16T00:08:17.297Z Last Updated: 2024-08-28T14:27:48.699Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In onNullBinding of TileLifecycleManager.java, there is a possible way to launch an activity from the background due to a missing null check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/frameworks/base/+/7b7fff1eb5014d12200a32ff9047da396c7ab6a4 - https://source.andro
ps://android.googlesource.com/platform/frameworks/base/+/7b7fff1eb5014d12200a32ff9047da396c7ab6a4 - https://source.android.com/security/bulletin/2024-02-01
CVE ID: CVE-2024-0036 State: PUBLISHED Published: 2024-02-16T00:08:17.660Z Last Updated: 2024-08-21T20:12:35.267Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In startNextMatchingActivity of ActivityTaskManagerService.java, there is a possible way to bypass the restrictions on starting activities from the background due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/frameworks/base/+/3eaaa9687e90
ntainer: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/frameworks/base/+/3eaaa9687e90c65f51762deb343f18bef95d4e8e - https://source.android.com/security/bulletin/2024-02-01
CVE ID: CVE-2024-0037 State: PUBLISHED Published: 2024-02-16T00:08:18.031Z Last Updated: 2024-12-03T15:55:14.401Z Vendors: Google Products: Android Problem Types: Information disclosure Description: In applyCustomDescription of SaveUi.java, there is a possible way to view images belonging to a different user due to a missing permission check. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/frameworks/base/+/55fc00a0788ea0995fe0851616b9ac21710a2931 - https://source.android.com
ndroid.googlesource.com/platform/frameworks/base/+/55fc00a0788ea0995fe0851616b9ac21710a2931 - https://source.android.com/security/bulletin/2024-02-01
CVE ID: CVE-2024-0038 State: PUBLISHED Published: 2024-02-16T00:08:18.446Z Last Updated: 2024-08-22T13:19:19.237Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In injectInputEventToInputFilter of AccessibilityManagerService.java, there is a possible arbitrary input event injection due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/frameworks/base/+/3e88d987235f5a2acd50a9b6bad78dbbf39cb079 - https
ferences: - https://android.googlesource.com/platform/frameworks/base/+/3e88d987235f5a2acd50a9b6bad78dbbf39cb079 - https://source.android.com/security/bulletin/2024-02-01
CVE ID: CVE-2024-0039 State: PUBLISHED Published: 2024-03-11T16:35:21.612Z Last Updated: 2025-03-13T18:24:30.462Z Vendors: Google Products: Android Problem Types: Remote code execution Description: In attp_build_value_cmd of att_protocol.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://android.googlesource.com/platform/packages/modules/Bluetooth/+/17044ccf3a2858633cad8f87926e752edfe0d8d8 - https://android.googlesource.com/platform/pac
rm/packages/modules/Bluetooth/+/17044ccf3a2858633cad8f87926e752edfe0d8d8 - https://android.googlesource.com/platform/packages/modules/Bluetooth/+/f0f35273101518d1f3a660b151804e90d0249af3 - https://android.googlesource.com/platform/packages/modules/Bluetooth/+/015c618a0461def93138173a53daaf27ca0630c9 - https://source.android.com/security/bulletin/2024-03-01
CVE ID: CVE-2024-0040 State: PUBLISHED Published: 2024-02-16T00:08:18.790Z Last Updated: 2024-08-01T17:41:15.511Z Vendors: Google Products: Android Problem Types: Information disclosure Description: In setParameter of MtpPacket.cpp, there is a possible out of bounds read due to a heap buffer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://android.googlesource.com/platform/frameworks/av/+/2ca6c27dc0336fd98f47cfb96dc514efa98e8864 - https://source.android.com/security/bulletin/2024-02-01
CVE ID: CVE-2024-0041 State: PUBLISHED Published: 2024-02-16T00:08:19.126Z Last Updated: 2025-03-28T15:54:45.173Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In removePersistentDot of SystemStatusAnimationSchedulerImpl.kt, there is a possible race condition due to a logic error in the code. This could lead to local escalation of privilege that fails to remove the persistent dot with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/frameworks/base/+/d6f7188773409c8f5ad5fc7d3eea5b1
Vulnrichment: References: - https://android.googlesource.com/platform/frameworks/base/+/d6f7188773409c8f5ad5fc7d3eea5b1751439e26 - https://source.android.com/security/bulletin/2024-02-01
CVE ID: CVE-2024-0042 State: PUBLISHED Published: 2024-05-07T21:01:29.018Z Last Updated: 2024-08-01T17:41:15.554Z Vendors: Google Products: Android Problem Types: Unknown Description: In TBD of TBD, there is a possible confusion of OEM and DRM certificates due to improperly used crypto. This could lead to local bypass of DRM content protection with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://source.android.com/security/bulletin/2024-04-01
CVE ID: CVE-2024-0043 State: PUBLISHED Published: 2024-05-07T21:03:30.780Z Last Updated: 2025-03-28T23:26:27.004Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In multiple locations, there is a possible notification listener grant to an app running in the work profile due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://android.googlesource.com/platform/packages/modules/Permission/+/8141e8f4dd77b9f8fb485e23ddf028c57fcd4fca - https://sou
//android.googlesource.com/platform/packages/modules/Permission/+/8141e8f4dd77b9f8fb485e23ddf028c57fcd4fca - https://source.android.com/security/bulletin/2024-05-01
CVE ID: CVE-2024-0044 State: PUBLISHED Published: 2024-03-11T16:35:21.760Z Last Updated: 2025-01-28T19:13:40.074Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In createSessionInternal of PackageInstallerService.java, there is a possible run-as any app due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://android.googlesource.com/platform/frameworks/base/+/954b2874b85b6cd0d6bb12cd677cdf22e5dbd77b - https://android.googlesource.com/pl
oglesource.com/platform/frameworks/base/+/954b2874b85b6cd0d6bb12cd677cdf22e5dbd77b - https://android.googlesource.com/platform/frameworks/base/+/836750619a8bce0bf78fe0549f9990e294671563 - https://source.android.com/security/bulletin/2024-10-01
CVE ID: CVE-2024-0045 State: PUBLISHED Published: 2024-03-11T16:35:21.876Z Last Updated: 2024-08-27T17:29:04.372Z Vendors: Google Products: Android Problem Types: Information disclosure Description: In smp_proc_sec_req of smp_act.cc, there is a possible out of bounds read due to improper input validation. This could lead to remote (proximal/adjacent) information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/packages/modules/Bluetooth/+/7d0f696f450241d8ba7a168ba14fa7b75032f0c9 - https://source.android.
ooglesource.com/platform/packages/modules/Bluetooth/+/7d0f696f450241d8ba7a168ba14fa7b75032f0c9 - https://source.android.com/security/bulletin/2024-03-01
CVE ID: CVE-2024-0046 State: PUBLISHED Published: 2024-03-11T16:35:21.955Z Last Updated: 2024-08-05T19:38:52.146Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In installExistingPackageAsUser of InstallPackageHelper.java, there is a possible carrier restriction bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/frameworks/base/+/d68cab5ac1aa294ec4d0419bc0803a5577e4e43c - https://source.andr
tps://android.googlesource.com/platform/frameworks/base/+/d68cab5ac1aa294ec4d0419bc0803a5577e4e43c - https://source.android.com/security/bulletin/2024-03-01
CVE ID: CVE-2024-0047 State: PUBLISHED Published: 2024-03-11T16:35:22.043Z Last Updated: 2025-03-27T15:16:09.506Z Vendors: Google Products: Android Problem Types: Denial of service Description: In writeUserLP of UserManagerService.java, device policies are serialized with an incorrect tag due to a logic error in the code. This could lead to local denial of service when policies are deserialized on reboot with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://android.googlesource.com/platform/frameworks/base/+/3cd8a2c783fc736627b38f639fe4e239abcf6af1 - ht
References: - https://android.googlesource.com/platform/frameworks/base/+/3cd8a2c783fc736627b38f639fe4e239abcf6af1 - https://android.googlesource.com/platform/frameworks/base/+/bd5cc7f03256b328438b9bc3791c6b811a2f1f17 - https://android.googlesource.com/platform/frameworks/base/+/f516739398746fef7e0cf1437d9a40e2ad3c10bb - https://source.android.com/security/bulletin/2024-03-01
CVE ID: CVE-2024-0048 State: PUBLISHED Published: 2024-03-11T16:35:22.131Z Last Updated: 2024-08-28T18:37:39.524Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In Session of AccountManagerService.java, there is a possible method to retain foreground service privileges due to incorrect handling of null responses. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/frameworks/base/+/2c236cde5505ee0e88cf1e3d073e2f1a53f0eede - https://
ences: - https://android.googlesource.com/platform/frameworks/base/+/2c236cde5505ee0e88cf1e3d073e2f1a53f0eede - https://source.android.com/security/bulletin/2024-03-01
CVE ID: CVE-2024-0049 State: PUBLISHED Published: 2024-03-11T16:35:22.215Z Last Updated: 2025-04-16T15:47:37.518Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In multiple locations, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://android.googlesource.com/platform/frameworks/av/+/462689f06fd5e72ac63cd87b43ee52554ddf953e - https://source.android.com/security/bulletin/2024-03-01
CVE ID: CVE-2024-0050 State: PUBLISHED Published: 2024-03-11T16:35:22.297Z Last Updated: 2024-08-14T20:09:30.390Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In getConfig of SoftVideoDecoderOMXComponent.cpp, there is a possible out of bounds write due to a missing validation check. This could lead to a local non-security issue with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/frameworks/av/+/8f3bc8be16480367bac36effa25706133a0dc22d - https://source.android.com/security/bullet
ource.com/platform/frameworks/av/+/8f3bc8be16480367bac36effa25706133a0dc22d - https://source.android.com/security/bulletin/2024-03-01
CVE ID: CVE-2024-0051 State: PUBLISHED Published: 2024-03-11T16:35:22.378Z Last Updated: 2024-08-28T19:01:42.953Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In onQueueFilled of SoftMPEG4.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/frameworks/av/+/a52c14a5b49f26efafa581dea653b4179d66909e - https://source.android.com/security/bulletin/2024-03-01
CVE ID: CVE-2024-0052 State: PUBLISHED Published: 2024-03-11T16:35:22.458Z Last Updated: 2025-03-13T18:34:28.839Z Vendors: Google Products: Android Problem Types: Information disclosure Description: In multiple functions of healthconnect, there is a possible leakage of exercise route data due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://android.googlesource.com/platform/packages/modules/HealthFitness/+/178f4824574fdf33ed4ac584d092240d1c771b04 - https://source.android
lesource.com/platform/packages/modules/HealthFitness/+/178f4824574fdf33ed4ac584d092240d1c771b04 - https://source.android.com/security/bulletin/2024-03-01
CVE ID: CVE-2024-0053 State: PUBLISHED Published: 2024-03-11T16:35:22.542Z Last Updated: 2025-03-27T15:48:15.415Z Vendors: Google Products: Android Problem Types: Information disclosure Description: In getCustomPrinterIcon of PrintManagerService.java, there is a possible way to view other user's images due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://android.googlesource.com/platform/frameworks/base/+/74b03835a7fac15e854d08159922418c99e27e77 - https://source.android.com/secur
.googlesource.com/platform/frameworks/base/+/74b03835a7fac15e854d08159922418c99e27e77 - https://source.android.com/security/bulletin/2024-03-01
CVE ID: CVE-2024-0054 State: PUBLISHED Published: 2024-03-19T06:35:15.078Z Last Updated: 2024-11-08T08:51:53.794Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Axis Communications AB Products: AXIS OS Problem Types: CWE-155 Description: Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX APIs local_list.cgi, create_overlay.cgi and irissetup.cgi was vulnerable for file globbing which could lead to a resource exhaustion attack. Axis has released patched AXIS OS versions for the highlighted flaw. Please refer to the Axis security advisory for more information and solution. Additional Analyst Notes: - CVE Program Container: - CISA
the Axis security advisory for more information and solution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.axis.com/dam/public/76/f3/1d/cve-2024-0054-en-US-432116.pdf
CVE ID: CVE-2024-0055 State: PUBLISHED Published: 2024-03-19T06:39:24.100Z Last Updated: 2024-11-08T08:51:23.936Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Axis Communications AB Products: AXIS OS Problem Types: CWE-155 Description: Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX APIs mediaclip.cgi and playclip.cgi was vulnerable for file globbing which could lead to a resource exhaustion attack. Axis has released patched AXIS OS versions for the highlighted flaw. Please refer to the Axis security advisory for more information and solution. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: Refe
sory for more information and solution. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.axis.com/dam/public/c4/00/c5/cve-2024-0055-en-US-432117.pdf
CVE ID: CVE-2024-0056 State: PUBLISHED Published: 2024-01-09T17:56:58.972Z Last Updated: 2025-06-03T14:30:31.644Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft SQL Server 2022 (GDR), .NET 6.0, .NET 7.0, .NET 8.0, Microsoft.Data.SqlClient, System.Data.SqlClient, Microsoft Visual Studio 2022 version 17.2, Microsoft Visual Studio 2022 version 17.4, Microsoft Visual Studio 2022 version 17.6, Microsoft Visual Studio 2022 version 17.8, Microsoft SQL Server 2022 (CU 10), Microsoft .NET Framework 4.8, Microsoft .NET Framework 3.5 AND 4.8, Microsoft .NET Framework 3.5 AND 4.7.2, Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.
rosoft .NET Framework 3.5 AND 4.8, Microsoft .NET Framework 3.5 AND 4.7.2, Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2, Microsoft .NET Framework 3.5 AND 4.8.1, Microsoft .NET Framework 2.0 Service Pack 2 Problem Types: CWE-319 Description: Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-0056
CVE ID: CVE-2024-0057 State: PUBLISHED Published: 2024-01-09T17:56:59.552Z Last Updated: 2025-06-03T14:30:26.630Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:P/RL:O/RC:C) Vendors: Microsoft Products: .NET 8.0, .NET 7.0, .NET 6.0, Microsoft Visual Studio 2022 version 17.2, Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10), Microsoft Visual Studio 2022 version 17.4, Microsoft Visual Studio 2022 version 17.6, Microsoft Visual Studio 2022 version 17.8, NuGet 5.11.0, NuGet 17.4.0, NUGET 17.6.0, NuGet 17.8.0, PowerShell 7.2, PowerShell 7.3, PowerShell 7.4, Microsoft .NET Framework 4.8, Microsoft .NET Framework 3.5 AND 4.8, Microsoft .NET Framework 3
hell 7.3, PowerShell 7.4, Microsoft .NET Framework 4.8, Microsoft .NET Framework 3.5 AND 4.8, Microsoft .NET Framework 3.5 AND 4.7.2, Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2, Microsoft .NET Framework 3.5 AND 4.8.1, Microsoft .NET Framework 2.0 Service Pack 2, Microsoft .NET Framework 3.0 Service Pack 2 Problem Types: CWE-20 Description: NET, .NET Framework, and Visual Studio Security Feature Bypass Vulnerability Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-0057
CVE ID: CVE-2024-0066 State: PUBLISHED Published: 2024-06-18T06:10:25.800Z Last Updated: 2024-11-08T08:50:35.312Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Axis Communications AB Products: AXIS OS Problem Types: CWE-319 Description: Johan Fagerström, member of the AXIS OS Bug Bounty Program, has found that a O3C feature may expose sensitive traffic between the client (Axis device) and (O3C) server. If O3C is not being used this flaw does not apply. Axis has released patched AXIS OS versions for the highlighted flaw. Please refer to the Axis security advisory for more information and solution. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Pro
e Axis security advisory for more information and solution. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.axis.com/dam/public/03/49/2c/cve-2024-0066-en-US-442553.pdf
CVE ID: CVE-2024-0067 State: PUBLISHED Published: 2024-09-10T04:54:45.733Z Last Updated: 2024-11-08T08:47:17.015Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Axis Communications AB Products: AXIS OS Problem Types: CWE-35 Description: Marinus Pfund, member of the AXIS OS Bug Bounty Program, has found the VAPIX API ledlimit.cgi was vulnerable for path traversal attacks allowing to list folder/file names on the local file system of the Axis device. Axis has released patched AXIS OS versions for the highlighted flaw. Please refer to the Axis security advisory for more information and solution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: -
s security advisory for more information and solution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.axis.com/dam/public/c7/d0/91/cve-2024-0067-en-US-448994.pdf