Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
d through a series of service procedures decrypt data contained in the Platform KeyStore. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7172698
CVE ID: CVE-2024-41783 State: PUBLISHED Published: 2025-01-19T14:58:21.249Z Last Updated: 2025-01-21T15:06:04.573Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: IBM Products: Sterling Secure Proxy Problem Types: CWE 1287 Improper Validation of Specified Type of Input Description: IBM Sterling Secure Proxy 6.0.0.0, 6.0.0.1, 6.0.0.2, 6.0.0.3, 6.1.0.0, and 6.2.0.0 could allow a privileged user to inject commands into the underlying operating system due to improper validation of a specified type of input. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7176189
CVE ID: CVE-2024-41784 State: PUBLISHED Published: 2024-11-15T15:40:57.009Z Last Updated: 2024-11-15T16:09:35.664Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: Sterling Secure Proxy Problem Types: CWE-32 Description: IBM Sterling Secure Proxy 6.0.0.0, 6.0.0.1, 6.0.0.2, 6.0.0.3, and 6.1.0.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot dot" sequences (/.../) to view arbitrary files on the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7173631
CVE ID: CVE-2024-41785 State: PUBLISHED Published: 2024-11-15T14:43:17.585Z Last Updated: 2024-11-15T17:17:45.507Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: IBM Products: Concert Software Problem Types: CWE-79 Description: IBM Concert Software 1.0.0 through 1.0.1 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7173596
CVE ID: CVE-2024-41787 State: PUBLISHED Published: 2025-01-10T13:18:51.866Z Last Updated: 2025-01-10T14:48:26.216Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: IBM Products: Engineering Requirements Management DOORS Next Problem Types: CWE-367 Description: IBM Engineering Requirements Management DOORS Next 7.0.2 and 7.0.3 could allow a remote attacker to bypass security restrictions, caused by a race condition. By sending a specially crafted request, an attacker could exploit this vulnerability to remotely execute code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7180636
CVE ID: CVE-2024-41788 State: PUBLISHED Published: 2025-04-08T08:22:00.872Z Last Updated: 2025-04-08T13:24:24.996Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Siemens Products: SENTRON 7KT PAC1260 Data Manager Problem Types: CWE-78 Description: A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions). The web interface of affected devices does not sanitize the input parameters in specific GET requests. This could allow an authenticated remote attacker to execute arbitrary code with root privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-187636.h
onal Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-187636.html
CVE ID: CVE-2024-41789 State: PUBLISHED Published: 2025-04-08T08:22:02.733Z Last Updated: 2025-04-08T13:22:14.446Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Siemens Products: SENTRON 7KT PAC1260 Data Manager Problem Types: CWE-78 Description: A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions). The web interface of affected devices does not sanitize the language parameter in specific POST requests. This could allow an authenticated remote attacker to execute arbitrary code with root privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-18763
itional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-187636.html
CVE ID: CVE-2024-41790 State: PUBLISHED Published: 2025-04-08T08:22:04.239Z Last Updated: 2025-04-08T13:21:17.545Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Siemens Products: SENTRON 7KT PAC1260 Data Manager Problem Types: CWE-78 Description: A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions). The web interface of affected devices does not sanitize the region parameter in specific POST requests. This could allow an authenticated remote attacker to execute arbitrary code with root privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-187636.
ional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-187636.html
CVE ID: CVE-2024-41791 State: PUBLISHED Published: 2025-04-08T08:22:05.720Z Last Updated: 2025-04-08T13:20:38.459Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: Siemens Products: SENTRON 7KT PAC1260 Data Manager Problem Types: CWE-306 Description: A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions). The web interface of affected devices does not authenticate report creation requests. This could allow an unauthenticated remote attacker to read or clear the log files on the device, reset the device or set the date and time. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/produc
e date and time. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-187636.html
CVE ID: CVE-2024-41792 State: PUBLISHED Published: 2025-04-08T08:22:08.546Z Last Updated: 2025-04-08T13:17:38.462Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: Siemens Products: SENTRON 7KT PAC1260 Data Manager Problem Types: CWE-22 Description: A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions). The web interface of affected devices contains a path traversal vulnerability. This could allow an unauthenticated attacker it to access arbitrary files on the device with root privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-187636.html
CVE ID: CVE-2024-41793 State: PUBLISHED Published: 2025-04-08T08:22:09.907Z Last Updated: 2025-04-08T13:39:41.981Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N) Vendors: Siemens Products: SENTRON 7KT PAC1260 Data Manager Problem Types: CWE-306 Description: A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions). The web interface of affected devices provides an endpoint that allows to enable the ssh service without authentication. This could allow an unauthenticated remote attacker to enable remote access to the device via ssh. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/h
via ssh. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-187636.html
CVE ID: CVE-2024-41794 State: PUBLISHED Published: 2025-04-08T08:22:11.279Z Last Updated: 2025-04-08T13:37:54.608Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Siemens Products: SENTRON 7KT PAC1260 Data Manager Problem Types: CWE-798 Description: A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions). Affected devices contain hardcoded credentials for remote access to the device operating system with root privileges. This could allow unauthenticated remote attackers to gain full access to a device, if they are in possession of these credentials and if the ssh service is enabled (e.g., by exploitation of CVE-2024-41793). Ad
y are in possession of these credentials and if the ssh service is enabled (e.g., by exploitation of CVE-2024-41793). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-187636.html
CVE ID: CVE-2024-41795 State: PUBLISHED Published: 2025-04-08T08:22:12.685Z Last Updated: 2025-04-08T13:37:07.939Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) Vendors: Siemens Products: SENTRON 7KT PAC1260 Data Manager Problem Types: CWE-352 Description: A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions). The web interface of affected devices is vulnerable to Cross-Site Request Forgery (CSRF) attacks. This could allow an unauthenticated attacker to change arbitrary device settings by tricking a legitimate device administrator to click on a malicious link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://
ce administrator to click on a malicious link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-187636.html
CVE ID: CVE-2024-41796 State: PUBLISHED Published: 2025-04-08T08:22:14.357Z Last Updated: 2025-04-08T13:31:32.350Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) Vendors: Siemens Products: SENTRON 7KT PAC1260 Data Manager Problem Types: CWE-620 Description: A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions). The web interface of affected devices allows to change the login password without knowing the current password. In combination with a prepared CSRF attack (CVE-2024-41795) an unauthenticated attacker could be able to set the password to an attacker-controlled value. Additional Analyst Notes: - CISA ADP Vulnrichment: References
able to set the password to an attacker-controlled value. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-187636.html
CVE ID: CVE-2024-41797 State: PUBLISHED Published: 2025-06-10T15:17:11.253Z Last Updated: 2025-06-10T17:12:12.653Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Siemens Products: RUGGEDCOM RST2428P, SCALANCE XC316-8, SCALANCE XC324-4, SCALANCE XC324-4 EEC, SCALANCE XC332, SCALANCE XC416-8, SCALANCE XC424-4, SCALANCE XC432, SCALANCE XCH328, SCALANCE XCM324, SCALANCE XCM328, SCALANCE XCM332, SCALANCE XR302-32, SCALANCE XR322-12, SCALANCE XR326-8, SCALANCE XR326-8 EEC, SCALANCE XR502-32, SCALANCE XR522-12, SCALANCE XR526-8, SCALANCE XRH334 (24 V DC, 8xFO, CC), SCALANCE XRM334 (230 V AC, 12xFO), SCALANCE XRM334 (230 V AC, 8xFO), SCALANCE XRM334 (230V AC, 2x10G
24 V DC, 8xFO, CC), SCALANCE XRM334 (230 V AC, 12xFO), SCALANCE XRM334 (230 V AC, 8xFO), SCALANCE XRM334 (230V AC, 2x10G, 24xSFP, 8xSFP+), SCALANCE XRM334 (24 V DC, 12xFO), SCALANCE XRM334 (24 V DC, 8xFO), SCALANCE XRM334 (24V DC, 2x10G, 24xSFP, 8xSFP+), SCALANCE XRM334 (2x230 V AC, 12xFO), SCALANCE XRM334 (2x230 V AC, 8xFO), SCALANCE XRM334 (2x230V AC, 2x10G, 24xSFP, 8xSFP+) Problem Types: CWE-269 Description: A vulnerability has been identified in RUGGEDCOM RST2428P (6GK6242-6PA00) (All versions < V3.1), SCALANCE XC316-8 (6GK5324-8TS00-2AC2) (All versions < V3.1), SCALANCE XC324-4 (6GK5328-4TS00-2AC2) (All versions < V3.1), SCALANCE XC324-4 EEC (6GK5328-4TS00-2EC2) (All versions < V3.1), S
E XC324-4 (6GK5328-4TS00-2AC2) (All versions < V3.1), SCALANCE XC324-4 EEC (6GK5328-4TS00-2EC2) (All versions < V3.1), SCALANCE XC332 (6GK5332-0GA00-2AC2) (All versions < V3.1), SCALANCE XC416-8 (6GK5424-8TR00-2AC2) (All versions < V3.1), SCALANCE XC424-4 (6GK5428-4TR00-2AC2) (All versions < V3.1), SCALANCE XC432 (6GK5432-0GR00-2AC2) (All versions < V3.1), SCALANCE XCH328 (6GK5328-4TS01-2EC2) (All versions < V3.1), SCALANCE XCM324 (6GK5324-8TS01-2AC2) (All versions < V3.1), SCALANCE XCM328 (6GK5328-4TS01-2AC2) (All versions < V3.1), SCALANCE XCM332 (6GK5332-0GA01-2AC2) (All versions < V3.1), SCALANCE XR302-32 (6GK5334-5TS00-2AR3) (All versions < V3.1), SCALANCE XR302-32 (6GK5334-5TS00-3AR3)
versions < V3.1), SCALANCE XR302-32 (6GK5334-5TS00-2AR3) (All versions < V3.1), SCALANCE XR302-32 (6GK5334-5TS00-3AR3) (All versions < V3.1), SCALANCE XR302-32 (6GK5334-5TS00-4AR3) (All versions < V3.1), SCALANCE XR322-12 (6GK5334-3TS00-2AR3) (All versions < V3.1), SCALANCE XR322-12 (6GK5334-3TS00-3AR3) (All versions < V3.1), SCALANCE XR322-12 (6GK5334-3TS00-4AR3) (All versions < V3.1), SCALANCE XR326-8 (6GK5334-2TS00-2AR3) (All versions < V3.1), SCALANCE XR326-8 (6GK5334-2TS00-3AR3) (All versions < V3.1), SCALANCE XR326-8 (6GK5334-2TS00-4AR3) (All versions < V3.1), SCALANCE XR326-8 EEC (6GK5334-2TS00-2ER3) (All versions < V3.1), SCALANCE XR502-32 (6GK5534-5TR00-2AR3) (All versions < V3.1),
CE XR326-8 EEC (6GK5334-2TS00-2ER3) (All versions < V3.1), SCALANCE XR502-32 (6GK5534-5TR00-2AR3) (All versions < V3.1), SCALANCE XR502-32 (6GK5534-5TR00-3AR3) (All versions < V3.1), SCALANCE XR502-32 (6GK5534-5TR00-4AR3) (All versions < V3.1), SCALANCE XR522-12 (6GK5534-3TR00-2AR3) (All versions < V3.1), SCALANCE XR522-12 (6GK5534-3TR00-3AR3) (All versions < V3.1), SCALANCE XR522-12 (6GK5534-3TR00-4AR3) (All versions < V3.1), SCALANCE XR526-8 (6GK5534-2TR00-2AR3) (All versions < V3.1), SCALANCE XR526-8 (6GK5534-2TR00-3AR3) (All versions < V3.1), SCALANCE XR526-8 (6GK5534-2TR00-4AR3) (All versions < V3.1), SCALANCE XRH334 (24 V DC, 8xFO, CC) (6GK5334-2TS01-2ER3) (All versions < V3.1), SCALAN
TR00-4AR3) (All versions < V3.1), SCALANCE XRH334 (24 V DC, 8xFO, CC) (6GK5334-2TS01-2ER3) (All versions < V3.1), SCALANCE XRM334 (230 V AC, 12xFO) (6GK5334-3TS01-3AR3) (All versions < V3.1), SCALANCE XRM334 (230 V AC, 8xFO) (6GK5334-2TS01-3AR3) (All versions < V3.1), SCALANCE XRM334 (230V AC, 2x10G, 24xSFP, 8xSFP+) (6GK5334-5TS01-3AR3) (All versions < V3.1), SCALANCE XRM334 (24 V DC, 12xFO) (6GK5334-3TS01-2AR3) (All versions < V3.1), SCALANCE XRM334 (24 V DC, 8xFO) (6GK5334-2TS01-2AR3) (All versions < V3.1), SCALANCE XRM334 (24V DC, 2x10G, 24xSFP, 8xSFP+) (6GK5334-5TS01-2AR3) (All versions < V3.1), SCALANCE XRM334 (2x230 V AC, 12xFO) (6GK5334-3TS01-4AR3) (All versions < V3.1), SCALANCE XRM3
R3) (All versions < V3.1), SCALANCE XRM334 (2x230 V AC, 12xFO) (6GK5334-3TS01-4AR3) (All versions < V3.1), SCALANCE XRM334 (2x230 V AC, 8xFO) (6GK5334-2TS01-4AR3) (All versions < V3.1), SCALANCE XRM334 (2x230V AC, 2x10G, 24xSFP, 8xSFP+) (6GK5334-5TS01-4AR3) (All versions < V3.1). Affected devices contain an incorrect authorization check vulnerability. This could allow an authenticated remote attacker with "guest" role to invoke an internal "do system" command which exceeds their privileges. This command allows the execution of certain low-risk actions, the most critical of which is clearing the local system log. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-po
which is clearing the local system log. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-633269.html
CVE ID: CVE-2024-41798 State: PUBLISHED Published: 2024-10-08T08:40:16.947Z Last Updated: 2024-10-08T14:06:17.123Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Siemens Products: SENTRON 7KM PAC3200 Problem Types: CWE-287 Description: A vulnerability has been identified in SENTRON 7KM PAC3200 (All versions). Affected devices only provide a 4-digit PIN to protect from administrative access via Modbus TCP interface. Attackers with access to the Modbus TCP interface could easily bypass this protection by brute-force attacks or by sniffing the Modbus clear text communication. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-porta
the Modbus clear text communication. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-850560.html
CVE ID: CVE-2024-41799 State: PUBLISHED Published: 2024-07-29T15:00:23.851Z Last Updated: 2024-08-02T04:46:52.940Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:H) Vendors: tgstation Products: tgstation-server Problem Types: CWE-22 Description: tgstation-server is a production scale tool for BYOND server management. Prior to 6.8.0, low permission users using the "Set .dme Path" privilege could potentially set malicious .dme files existing on the host machine to be compiled and executed. These .dme files could be uploaded via tgstation-server (requiring a separate, isolated privilege) or some other means. A server configured to execute in BYOND's trusted security level (
a separate, isolated privilege) or some other means. A server configured to execute in BYOND's trusted security level (requiring a third separate, isolated privilege OR being set by another user) could lead to this escalating into remote code execution via BYOND's shell() proc. The ability to execute this kind of attack is a known side effect of having privileged TGS users, but normally requires multiple privileges with known weaknesses. This vector is not intentional as it does not require control over the where deployment code is sourced from and _may_ not require remote write access to an instance's `Configuration` directory. This problem is fixed in versions 6.8.0 and above. Additional
write access to an instance's `Configuration` directory. This problem is fixed in versions 6.8.0 and above. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/tgstation/tgstation-server/security/advisories/GHSA-c3h4-9gc2-f7h4 - https://github.com/tgstation/tgstation-server/pull/1835 - https://github.com/tgstation/tgstation-server/commit/374852fe5ae306415eb5aafb2d16b06897d7afe4
CVE ID: CVE-2024-41800 State: PUBLISHED Published: 2024-07-25T16:12:58.907Z Last Updated: 2024-08-02T04:46:52.695Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N) Vendors: craftcms Products: cms Problem Types: CWE-287 Description: Craft is a content management system (CMS). Craft CMS 5 allows reuse of TOTP tokens multiple times within the validity period. An attacker is able to re-submit a valid TOTP token to establish an authenticated session. This requires that the attacker has knowledge of the victim's credentials. This has been patched in Craft 5.2.3. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/craf
5.2.3. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/craftcms/cms/security/advisories/GHSA-wmx7-pw49-88jx - https://github.com/craftcms/cms/commit/7c790fa5ad5a8cb8016cb6793ec3554c4c079e38 - https://github.com/craftcms/cms/releases/tag/5.2.3 - https://github.com/sbaresearch/advisories/tree/public/2024/SBA-ADV-20240617-01_CraftCMS_TOTP_Valid_After_Use
CVE ID: CVE-2024-41801 State: PUBLISHED Published: 2024-07-25T16:50:16.180Z Last Updated: 2024-08-02T04:46:52.668Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N) Vendors: opf Products: openproject Problem Types: CWE-601 Description: OpenProject is open source project management software. Prior to version 14.3.0, using a forged HOST header in the default configuration of packaged installations and using the "Login required" setting, an attacker could redirect to a remote host to initiate a phishing attack against an OpenProject user's account. This vulnerability affects default packaged installation of OpenProject without any additional configuration or modules on Ap
vulnerability affects default packaged installation of OpenProject without any additional configuration or modules on Apache (such as mod_security, manually setting a host name, having a fallthrough VirtualHost). It might also affect other installations that did not take care to fix the HOST/X-Forwarded-Host headers. Version 14.3.0 includes stronger protections for the hostname from within the application using the HostAuthorization middleware of Rails to reject any requests with a host name that does not match the configured one. Also, all generated links by the application are now ensured to use the built-in hostname. Users who aren't able to upgrade immediately may use mod_security for Ap
n are now ensured to use the built-in hostname. Users who aren't able to upgrade immediately may use mod_security for Apache2 or manually fix the Host and X-Forwarded-Host headers in their proxying application before reaching the application server of OpenProject. Alternatively, they can manually apply the patch to opt-in to host header protections in previous versions of OpenProject. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/opf/openproject/security/advisories/GHSA-g92v-vrq6-4fpw - https://github.com/user-attachments/files/16371759/host-protection.patch - https://www.openproject.org/docs/release-notes/14-3-0
CVE ID: CVE-2024-41802 State: PUBLISHED Published: 2024-07-30T15:49:52.120Z Last Updated: 2024-08-02T04:46:52.692Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: xibosignage Products: xibo-cms Problem Types: CWE-89 Description: Xibo is a content management system (CMS). An SQL injection vulnerability was discovered in the API routes inside the CMS responsible for Filtering DataSets. This allows an authenticated user to to obtain and modify arbitrary data from the Xibo database by injecting specially crafted values in to the APIs for importing JSON and importing a Layout containing DataSet data. Users should upgrade to version 3.3.12 or 4.0.14 which fix this i
g JSON and importing a Layout containing DataSet data. Users should upgrade to version 3.3.12 or 4.0.14 which fix this issue Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-x4qm-vvhp-g7c2 - https://github.com/xibosignage/xibo-cms/commit/b7a5899338cd841a39702e3fcaff76aa0ffe4075 - https://xibosignage.com/blog/security-advisory-2024-07
CVE ID: CVE-2024-41803 State: PUBLISHED Published: 2024-07-30T15:49:51.716Z Last Updated: 2024-08-02T04:46:52.683Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: xibosignage Products: xibo-cms Problem Types: CWE-89 Description: Xibo is a content management system (CMS). An SQL injection vulnerability was discovered in the API routes inside the CMS responsible for Filtering DataSets. This allows an authenticated user to to obtain arbitrary data from the Xibo database by injecting specially crafted values in to the API for viewing DataSet data. Users should upgrade to version 3.3.12 or 4.0.14 which fix this issue. Additional Analyst Notes: - CISA ADP Vulnrich
ta. Users should upgrade to version 3.3.12 or 4.0.14 which fix this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-hpc5-mxfq-44hv - https://github.com/xibosignage/xibo-cms/commit/39a2fd54b3f08831b0004aa2015bd8a753bc567f.patch - https://xibosignage.com/blog/security-advisory-2024-07
CVE ID: CVE-2024-41804 State: PUBLISHED Published: 2024-07-30T15:51:53.961Z Last Updated: 2024-08-02T04:46:52.668Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N) Vendors: xibosignage Products: xibo-cms Problem Types: CWE-89 Description: Xibo is a content management system (CMS). An SQL injection vulnerability was discovered in the API route inside the CMS responsible for Adding/Editing DataSet Column Formulas. This allows an authenticated user to to obtain and modify arbitrary data from the Xibo database by injecting specially crafted values in to the `formula` parameter. Users should upgrade to version 3.3.12 or 4.0.14 which fix this issue. Additional Analyst Notes