Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-22216 State: PUBLISHED Published: 2024-01-08T00:00:00.000Z Last Updated: 2025-06-18T16:54:35.287Z Vendors: n/a Products: n/a Problem Types: n/a Description: In default installations of Microchip maxView Storage Manager (for Adaptec Smart Storage Controllers) where Redfish server is configured for remote system management, unauthorized access can occur, with data modification and information disclosure. This affects 3.00.23484 through 4.14.00.26064 (except for the patched versions 3.07.23980 and 4.07.00.25339). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.microchip.com/en-us/solutions/embedded-security/how-to-report-pot
er: - CISA ADP Vulnrichment: References: - https://www.microchip.com/en-us/solutions/embedded-security/how-to-report-potential-product-security-vulnerabilities/maxview-storage-manager-redfish-server-vulnerability
CVE ID: CVE-2024-22217 State: PUBLISHED Published: 2024-08-15T00:00:00.000Z Last Updated: 2025-03-24T16:34:09.394Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Server-Side Request Forgery (SSRF) vulnerability in Terminalfour before 8.3.19 allows authenticated users to use specific features to access internal services including sensitive information on the server that Terminalfour runs on. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.terminalfour.com/articles/release-notes-highlights/ - https://docs.terminalfour.com/release-notes/security-notices/cve-2024-22217/
CVE ID: CVE-2024-22218 State: PUBLISHED Published: 2024-08-15T00:00:00 Last Updated: 2024-08-15T18:28:29.280Z Vendors: n/a Products: n/a Problem Types: n/a Description: XML External Entity (XXE) vulnerability in Terminalfour 8.0.0001 through 8.3.18 and XML JDBC versions up to 1.0.4 allows authenticated users to submit malicious XML via unspecified features which could lead to various actions such as accessing the underlying server, remote code execution (RCE), or performing Server-Side Request Forgery (SSRF) attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.terminalfour.com/articles/release-notes-highlights/ - https://docs.terminalfour.com/release-notes/s
nces: - https://docs.terminalfour.com/articles/release-notes-highlights/ - https://docs.terminalfour.com/release-notes/security-notices/cve-2024-22218--cve-2024-22219/
CVE ID: CVE-2024-22219 State: PUBLISHED Published: 2024-08-15T00:00:00 Last Updated: 2024-08-19T17:24:08.273Z Vendors: n/a Products: n/a Problem Types: n/a Description: XML External Entity (XXE) vulnerability in Terminalfour 8.0.0001 through 8.3.18 and XML JDBC versions up to 1.0.4 allows authenticated users to submit malicious XML via unspecified features which could lead to various actions such as accessing the underlying server, remote code execution (RCE), or performing Server-Side Request Forgery (SSRF) attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.terminalfour.com/articles/release-notes-highlights/ - https://docs.terminalfour.com/release-notes/s
CVE ID: CVE-2024-22220 State: PUBLISHED Published: 2024-02-21T00:00:00 Last Updated: 2024-11-21T16:50:21.767Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Terminalfour 7.4 through 7.4.0004 QP3 and 8 through 8.3.19, and Formbank through 2.1.10-FINAL. Unauthenticated Stored Cross-Site Scripting can occur, with resultant Admin Session Hijacking. The attack vectors are Form Builder and Form Preview. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://docs.terminalfour.com/articles/release-notes-highlights/ - https://docs.terminalfour.com/release-notes/security-notices/cve-2024-22220/
CVE ID: CVE-2024-22221 State: PUBLISHED Published: 2024-02-12T19:00:21.935Z Last Updated: 2024-09-17T14:55:52.090Z Severity: MEDIUM (CVSS 4.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N) Vendors: Dell Products: Unity Problem Types: CWE-89 Description: Dell Unity, versions prior to 5.4, contains SQL Injection vulnerability. An authenticated attacker could potentially exploit this vulnerability, leading to exposure of sensitive information. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000222010/dsa-2024-042-dell-unity-dell-unity-vsa-and-dell-unity-xt-security-update-for-multiple-vulnerabilities
CVE ID: CVE-2024-22222 State: PUBLISHED Published: 2024-02-12T19:04:21.768Z Last Updated: 2024-08-01T22:43:33.551Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Dell Products: Unity Problem Types: CWE-78 Description: Dell Unity, versions prior to 5.4, contains an OS Command Injection Vulnerability within its svc_udoctor utility. An authenticated malicious user with local access could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the application's underlying OS, with the privileges of the vulnerable application. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.
able application. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/en-us/000222010/dsa-2024-042-dell-unity-dell-unity-vsa-and-dell-unity-xt-security-update-for-multiple-vulnerabilities
CVE ID: CVE-2024-22223 State: PUBLISHED Published: 2024-02-12T19:07:05.811Z Last Updated: 2025-05-07T20:55:48.506Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Dell Products: Unity Problem Types: CWE-78 Description: Dell Unity, versions prior to 5.4, contains an OS Command Injection Vulnerability within its svc_cbr utility. An authenticated malicious user with local access could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the application's underlying OS, with the privileges of the vulnerable application. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.dell
application. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000222010/dsa-2024-042-dell-unity-dell-unity-vsa-and-dell-unity-xt-security-update-for-multiple-vulnerabilities
CVE ID: CVE-2024-22224 State: PUBLISHED Published: 2024-02-12T18:48:31.147Z Last Updated: 2025-05-07T20:56:14.715Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Dell Products: Unity Problem Types: CWE-78 Description: Dell Unity, versions prior to 5.4, contains an OS Command Injection Vulnerability in its svc_nas utility. An authenticated attacker could potentially exploit this vulnerability, escaping the restricted shell and execute arbitrary operating system commands with root privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000222010/dsa-2024-042-dell-unity-dell-u
CVE ID: CVE-2024-22225 State: PUBLISHED Published: 2024-02-12T18:51:34.460Z Last Updated: 2025-05-07T20:56:36.736Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Dell Products: Unity Problem Types: CWE-78 Description: Dell Unity, versions prior to 5.4, contains an OS Command Injection Vulnerability in its svc_supportassist utility. An authenticated attacker could potentially exploit this vulnerability, leading to execution of arbitrary operating system commands with root privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000222010/dsa-2024-042-dell-unity-dell-unity-vsa
DP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000222010/dsa-2024-042-dell-unity-dell-unity-vsa-and-dell-unity-xt-security-update-for-multiple-vulnerabilities
CVE ID: CVE-2024-22226 State: PUBLISHED Published: 2024-02-12T18:55:44.482Z Last Updated: 2024-08-01T22:43:33.567Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Dell Products: Unity Problem Types: CWE-23 Description: Dell Unity, versions prior to 5.4, contain a path traversal vulnerability in its svc_supportassist utility. An authenticated attacker could potentially exploit this vulnerability, to gain unauthorized write access to the files stored on the server filesystem, with elevated privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/en-us/000222010/dsa-2024-042-dell-unity
hment: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/en-us/000222010/dsa-2024-042-dell-unity-dell-unity-vsa-and-dell-unity-xt-security-update-for-multiple-vulnerabilities
CVE ID: CVE-2024-22227 State: PUBLISHED Published: 2024-02-12T18:37:41.561Z Last Updated: 2025-05-07T20:56:55.848Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Dell Products: Unity Problem Types: CWE-78 Description: Dell Unity, versions prior to 5.4, contains an OS Command Injection Vulnerability in its svc_dc utility. An authenticated attacker could potentially exploit this vulnerability, leading to the ability execute commands with root privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000222010/dsa-2024-042-dell-unity-dell-unity-vsa-and-dell-unity-xt-security-upd
https://www.dell.com/support/kbdoc/en-us/000222010/dsa-2024-042-dell-unity-dell-unity-vsa-and-dell-unity-xt-security-update-for-multiple-vulnerabilities
CVE ID: CVE-2024-22228 State: PUBLISHED Published: 2024-02-12T18:40:56.704Z Last Updated: 2025-05-07T20:57:17.073Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Dell Products: Unity Problem Types: CWE-78 Description: Dell Unity, versions prior to 5.4, contains an OS Command Injection Vulnerability in its svc_cifssupport utility. An authenticated attacker could potentially exploit this vulnerability, escaping the restricted shell and execute arbitrary operating system commands with root privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000222010/dsa-2024-042-dell-unit
tainer: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000222010/dsa-2024-042-dell-unity-dell-unity-vsa-and-dell-unity-xt-security-update-for-multiple-vulnerabilities
CVE ID: CVE-2024-22229 State: PUBLISHED Published: 2024-01-24T16:17:57.906Z Last Updated: 2024-08-23T19:03:34.677Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Dell Products: Unity Problem Types: CWE-117 Description: Dell Unity, versions prior to 5.4, contain a vulnerability whereby log messages can be spoofed by an authenticated attacker. An attacker could exploit this vulnerability to forge log entries, create false alarms, and inject malicious content into logs that compromise logs integrity. A malicious attacker could also prevent the product from logging information while malicious actions are performed or implicate an arbitrary user for malicious activ
roduct from logging information while malicious actions are performed or implicate an arbitrary user for malicious activities. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000213152/dsa-2023-141-dell-unity-unity-vsa-and-unity-xt-security-update-for-multiple-vulnerabilities
CVE ID: CVE-2024-22230 State: PUBLISHED Published: 2024-02-12T18:45:18.975Z Last Updated: 2024-08-19T14:40:25.778Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: Dell Products: Unity Problem Types: CWE-79 Description: Dell Unity, versions prior to 5.4, contains a Cross-site scripting vulnerability. An authenticated attacker could potentially exploit this vulnerability, stealing session information, masquerading as the affected user or carry out any actions that this user could perform, or to generally control the victim's browser. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-
al Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000222010/dsa-2024-042-dell-unity-dell-unity-vsa-and-dell-unity-xt-security-update-for-multiple-vulnerabilities
CVE ID: CVE-2024-22231 State: PUBLISHED Published: 2024-06-27T06:51:44.428Z Last Updated: 2024-10-30T18:36:23.980Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N) Vendors: VMware Products: Salt Project Description: Syndic cache directory creation is vulnerable to a directory traversal attack in salt project which can lead a malicious attacker to create an arbitrary directory on a Salt master. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://saltproject.io/security-announcements/2024-01-31-advisory/
CVE ID: CVE-2024-22232 State: PUBLISHED Published: 2024-06-27T06:54:08.785Z Last Updated: 2024-11-05T15:22:05.620Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: VMware Products: Salt Project Description: A specially crafted url can be created which leads to a directory traversal in the salt file server. A malicious user can read an arbitrary file from a Salt master’s filesystem. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://saltproject.io/security-announcements/2024-01-31-advisory/
CVE ID: CVE-2024-22233 State: PUBLISHED Published: 2024-01-22T12:16:15.223Z Last Updated: 2025-06-20T18:41:29.445Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Spring Products: Spring Framework Description: In Spring Framework versions 6.0.15 and 6.1.2, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition. Specifically, an application is vulnerable when all of the following are true: * the application uses Spring MVC * Spring Security 6.1.6+ or 6.2.1+ is on the classpath Typically, Spring Boot applications need the org.springframework.boot:spring-boot-starter-web and org.springframework.boot
pically, Spring Boot applications need the org.springframework.boot:spring-boot-starter-web and org.springframework.boot:spring-boot-starter-security dependencies to meet all conditions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://spring.io/security/cve-2024-22233/ - https://security.netapp.com/advisory/ntap-20240614-0005/
CVE ID: CVE-2024-22234 State: PUBLISHED Published: 2024-02-20T07:02:50.873Z Last Updated: 2025-02-13T17:33:37.468Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: Spring Products: Spring Security Description: In Spring Security, versions 6.1.x prior to 6.1.7 and versions 6.2.x prior to 6.2.2, an application is vulnerable to broken access control when it directly uses the AuthenticationTrustResolver.isFullyAuthenticated(Authentication) method. Specifically, an application is vulnerable if: * The application uses AuthenticationTrustResolver.isFullyAuthenticated(Authentication) directly and a null authentication parameter is passed to it resulting in an erroneous
ullyAuthenticated(Authentication) directly and a null authentication parameter is passed to it resulting in an erroneous true return value. An application is not vulnerable if any of the following is true: * The application does not use AuthenticationTrustResolver.isFullyAuthenticated(Authentication) directly. * The application does not pass null to AuthenticationTrustResolver.isFullyAuthenticated * The application only uses isFullyAuthenticated via Method Security https://docs.spring.io/spring-security/reference/servlet/authorization/method-security.html or HTTP Request Security https://docs.spring.io/spring-security/reference/servlet/authorization/authorize-http-requests.html Additional An
curity https://docs.spring.io/spring-security/reference/servlet/authorization/authorize-http-requests.html Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://spring.io/security/cve-2024-22234 - https://security.netapp.com/advisory/ntap-20240315-0003/
CVE ID: CVE-2024-22235 State: PUBLISHED Published: 2024-02-21T04:59:48.892Z Last Updated: 2025-03-20T19:25:06.024Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: n/a Products: VMware Aria Operations Description: VMware Aria Operations contains a local privilege escalation vulnerability. A malicious actor with administrative access to the local system can escalate privileges to 'root'. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.vmware.com/security/advisories/VMSA-2024-0004.html
CVE ID: CVE-2024-22236 State: PUBLISHED Published: 2024-01-31T06:54:51.091Z Last Updated: 2025-06-03T18:43:58.133Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Spring Products: Spring Cloud Contract Description: In Spring Cloud Contract, versions 4.1.x prior to 4.1.1, versions 4.0.x prior to 4.0.5, and versions 3.1.x prior to 3.1.10, test execution is vulnerable to local information disclosure via temporary directory created with unsafe permissions through the shaded com.google.guava:guava dependency in the org.springframework.cloud:spring-cloud-contract-shade dependency. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References:
cloud-contract-shade dependency. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://spring.io/security/cve-2024-22236
CVE ID: CVE-2024-22237 State: PUBLISHED Published: 2024-02-06T19:36:09.748Z Last Updated: 2025-05-15T19:43:55.632Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: n/a Products: VMware Aria Operations for Networks Problem Types: Local Privilege Escalation vulnerability Description: Aria Operations for Networks contains a local privilege escalation vulnerability. A console user with access to Aria Operations for Networks may exploit this vulnerability to escalate privileges to gain root access to the system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.vmware.com/security/advisories/VMSA-2024-0002.html
CVE ID: CVE-2024-22238 State: PUBLISHED Published: 2024-02-06T19:37:08.932Z Last Updated: 2025-06-03T18:44:43.270Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:H) Vendors: n/a Products: VMware Aria Operations for Networks Problem Types: Cross Site Scripting Vulnerability Description: Aria Operations for Networks contains a cross site scripting vulnerability. A malicious actor with admin privileges may be able to inject malicious code into user profile configurations due to improper input sanitization. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.vmware.com/security/advisories/VMSA-2024-0002.html
CVE ID: CVE-2024-22239 State: PUBLISHED Published: 2024-02-06T19:37:57.515Z Last Updated: 2025-05-15T19:43:48.984Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: n/a Products: VMware Aria Operations for Networks Problem Types: Local Privilege Escalation vulnerability Description: Aria Operations for Networks contains a local privilege escalation vulnerability. A console user with access to Aria Operations for Networks may exploit this vulnerability to escalate privileges to gain regular shell access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.vmware.com/security/advisories/VMSA-2024-0002.html
CVE ID: CVE-2024-22240 State: PUBLISHED Published: 2024-02-06T19:39:05.468Z Last Updated: 2025-05-15T19:43:42.956Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: n/a Products: VMware Aria Operations for Networks Problem Types: Local File Read vulnerability Description: Aria Operations for Networks contains a local file read vulnerability. A malicious actor with admin privileges may exploit this vulnerability leading to unauthorized access to sensitive information. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.vmware.com/security/advisories/VMSA-2024-0002.html
CVE ID: CVE-2024-22241 State: PUBLISHED Published: 2024-02-06T19:48:26.955Z Last Updated: 2025-06-03T18:45:18.112Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L) Vendors: n/a Products: VMware Aria Operations for Networks Problem Types: Cross Site Scripting vulnerability Description: Aria Operations for Networks contains a cross site scripting vulnerability. A malicious actor with admin privileges can inject a malicious payload into the login banner and takeover the user account. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.vmware.com/security/advisories/VMSA-2024-0002.html
CVE ID: CVE-2024-22243 State: PUBLISHED Published: 2024-02-23T05:03:54.426Z Last Updated: 2025-02-13T17:33:38.355Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: Spring Products: Spring Framework Description: Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html attack or to a SSRF attack if the URL is used after passing validation checks. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://spring.io/security/cve-2
ditional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://spring.io/security/cve-2024-22243 - https://security.netapp.com/advisory/ntap-20240524-0001/
CVE ID: CVE-2024-22244 State: PUBLISHED Published: 2024-06-10T23:02:59.347Z Last Updated: 2024-08-01T22:43:33.635Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: Harbor Products: Harbor Problem Types: CWE-601 Description: Open Redirect in Harbor <=v2.8.4, <=v2.9.2, and <=v2.10.0 may redirect a user to a malicious site. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/goharbor/harbor/security/advisories/GHSA-5757-v49g-f6r7
CVE ID: CVE-2024-22245 State: PUBLISHED Published: 2024-02-20T17:35:09.051Z Last Updated: 2024-08-27T15:18:28.113Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: VMware Products: VMware Enhanced Authentication Plug-in (EAP) Problem Types: CWE-287 Description: Arbitrary Authentication Relay and Session Hijack vulnerabilities in the deprecated VMware Enhanced Authentication Plug-in (EAP) could allow a malicious actor that could trick a target domain user with EAP installed in their web browser into requesting and relaying service tickets for arbitrary Active Directory Service Principal Names (SPNs). Additional Analyst Notes: - CVE Program Container: - CISA
or arbitrary Active Directory Service Principal Names (SPNs). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.vmware.com/security/advisories/VMSA-2024-0003.html
CVE ID: CVE-2024-22246 State: PUBLISHED Published: 2024-04-02T15:48:23.171Z Last Updated: 2024-08-01T22:43:34.263Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: N/A Products: VMware SD-WAN Edge Problem Types: Unauthenticated Command Injection vulnerability in SD-WAN Edge Description: VMware SD-WAN Edge contains an unauthenticated command injection vulnerability potentially leading to remote code execution. A malicious actor with local access to the Edge Router UI during activation may be able to perform a command injection attack that could lead to full control of the router. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: Referen