Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
r has completed restart, and executed XSS would be done within a logged-out context. The issue is fixed in GoCD 24.1.0. As a workaround, it is technically possible in earlier GoCD versions to override the loading page with an earlier version which is not vulnerable, by starting GoCD with the Java system property override as either `-Dloading.page.resource.path=/loading_pages/default.loading.page.html` (simpler early version of loading page without GoCD introduction) or `-Dloading.page.resource.path=/does_not_exist.html` (to display a simple message with no interactivity). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/gocd/gocd/se
dditional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/gocd/gocd/security/advisories/GHSA-q882-q6mm-mgvh - https://github.com/gocd/gocd/commit/388d8893ec4cac51d2b76e923cc9b55c7703e402 - https://github.com/gocd/gocd/releases/tag/24.1.0 - https://www.gocd.org/releases/#24-1-0
CVE ID: CVE-2024-28867 State: PUBLISHED Published: 2024-03-29T14:26:22.194Z Last Updated: 2025-03-25T14:39:04.232Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: swift-server Products: swift-prometheus Problem Types: CWE-74 Description: Swift Prometheus is a Swift client for the Prometheus monitoring system, supporting counters, gauges and histograms. In code which applies _un-sanitized string values into metric names or labels_, an attacker could make use of this and send a `?lang` query parameter containing newlines, `}` or similar characters which can lead to the attacker taking over the exported format -- including creating unbounded numbers of stored m
cters which can lead to the attacker taking over the exported format -- including creating unbounded numbers of stored metrics, inflating server memory usage, or causing "bogus" metrics. This vulnerability is fixed in2.0.0-alpha.2. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/swift-server/swift-prometheus/security/advisories/GHSA-x768-cvr2-345r - https://github.com/swift-server/swift-prometheus/commit/bfcd4bbfabe11aae4b035424ee9724582e288501
CVE ID: CVE-2024-28868 State: PUBLISHED Published: 2024-03-20T20:07:42.364Z Last Updated: 2024-08-02T00:56:58.154Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: umbraco Products: Umbraco-CMS Problem Types: CWE-204 Description: Umbraco is an ASP.NET content management system. Umbraco 10 prior to 10.8.4 with access to the native login screen is vulnerable to a possible user enumeration attack. This issue was fixed in version 10.8.5. As a workaround, one may disable the native login screen by exclusively using external logins. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/umbraco/Umbraco-CMS/security
t Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-552f-97wf-pmpq - https://github.com/umbraco/Umbraco-CMS/commit/7e1d1a1968000226cd882fff078b122b8d46c44d
CVE ID: CVE-2024-28869 State: PUBLISHED Published: 2024-04-12T21:08:36.288Z Last Updated: 2024-08-02T00:56:58.412Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: traefik Products: traefik Problem Types: CWE-755 Description: Traefik is an HTTP reverse proxy and load balancer. In affected versions sending a GET request to any Traefik endpoint with the "Content-length" request header results in an indefinite hang with the default configuration. This vulnerability can be exploited by attackers to induce a denial of service. This vulnerability has been addressed in version 2.11.2 and 3.0.0-rc5. Users are advised to upgrade. For affected versions, this vulnerabilit
s been addressed in version 2.11.2 and 3.0.0-rc5. Users are advised to upgrade. For affected versions, this vulnerability can be mitigated by configuring the readTimeout option. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/traefik/traefik/security/advisories/GHSA-4vwx-54mw-vqfw - https://github.com/traefik/traefik/commit/240b83b77351dfd8cadb91c305b84e9d22e0f9c6 - https://doc.traefik.io/traefik/routing/entrypoints/#respondingtimeouts - https://github.com/traefik/traefik/releases/tag/v2.11.2 - https://github.com/traefik/traefik/releases/tag/v3.0.0-rc5
CVE ID: CVE-2024-28870 State: PUBLISHED Published: 2024-04-03T21:13:48.470Z Last Updated: 2024-08-02T00:56:58.358Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: OISF Products: suricata Problem Types: CWE-770 Description: Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine developed by the OISF and the Suricata community. When parsing an overly long SSH banner, Suricata can use excessive CPU resources, as well as cause excessive logging volume in alert records. This issue has been patched in versions 6.0.17 and 7.0.4. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: Re
een patched in versions 6.0.17 and 7.0.4. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/OISF/suricata/security/advisories/GHSA-mhhx-xw7r-r5c8
CVE ID: CVE-2024-28871 State: PUBLISHED Published: 2024-04-04T14:46:02.803Z Last Updated: 2024-08-26T20:45:59.274Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: OISF Products: libhtp Problem Types: CWE-770 Description: LibHTP is a security-aware parser for the HTTP protocol and the related bits and pieces. Version 0.5.46 may parse malformed request traffic, leading to excessive CPU usage. Version 0.5.47 contains a patch for the issue. No known workarounds are available. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/OISF/libhtp/security/advisories/GHSA-ffr2-45w9-7wmg - https://github.com/OISF/libh
ent: References: - https://github.com/OISF/libhtp/security/advisories/GHSA-ffr2-45w9-7wmg - https://github.com/OISF/libhtp/commit/79e713f3e527593a45f545e854cd9e6fbb3cd3ed - https://github.com/OISF/libhtp/commit/bf618ec7f243cebfb0f7e84c3cb158955cb32b4d - https://redmine.openinfosecfoundation.org/issues/6757
CVE ID: CVE-2024-28872 State: PUBLISHED Published: 2024-07-11T14:49:12.156Z Last Updated: 2025-03-26T14:40:49.861Z Severity: HIGH (CVSS 8.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:H) Vendors: ISC Products: Stork Description: The TLS certificate validation code is flawed. An attacker can obtain a TLS certificate from the Stork server and use it to connect to the Stork agent. Once this connection is established with the valid certificate, the attacker can send malicious commands to a monitored service (Kea or BIND 9), possibly resulting in confidential data loss and/or denial of service. It should be noted that this vulnerability is not related to BIND 9 or Kea directly, and only customers
ial of service. It should be noted that this vulnerability is not related to BIND 9 or Kea directly, and only customers using the Stork management tool are potentially affected. This issue affects Stork versions 0.15.0 through 1.15.0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://kb.isc.org/docs/cve-2024-28872
CVE ID: CVE-2024-28875 State: PUBLISHED Published: 2024-10-30T13:35:19.982Z Last Updated: 2025-11-03T21:54:34.037Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: LevelOne Products: WBR-6012 Problem Types: CWE-798 Description: A security flaw involving hard-coded credentials in LevelOne WBR-6012's web services allows attackers to gain unauthorized access during the first 30 seconds post-boot. Other vulnerabilities can force a reboot, circumventing the initial time restriction for exploitation.The backdoor string can be found at address 0x80100910 80100910 40 6d 21 74 ds "@m!t2K1" 32 4b 31 00 It is referenced by the function located at 0x800b78b0 and is used as
0910 80100910 40 6d 21 74 ds "@m!t2K1" 32 4b 31 00 It is referenced by the function located at 0x800b78b0 and is used as shown in the pseudocode below: if ((SECOND_FROM_BOOT_TIME < 300) && (is_equal = strcmp(password,"@m!t2K1")) { return 1;} Where 1 is the return value to admin-level access (0 being fail and 3 being user). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2024-1979
CVE ID: CVE-2024-28876 State: PUBLISHED Published: 2024-08-14T13:45:22.685Z Last Updated: 2024-08-14T15:53:18.480Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) MPI Library software Problem Types: escalation of privilege, CWE-427 Description: Uncontrolled search path for some Intel(R) MPI Library software before version 2021.12 may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01115.html
CVE ID: CVE-2024-28877 State: PUBLISHED Published: 2024-06-11T20:15:14.566Z Last Updated: 2024-08-02T00:56:58.121Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: MicroDicom Products: DICOM Viewer Problem Types: CWE-121 Description: MicroDicom DICOM Viewer is vulnerable to a stack-based buffer overflow, which may allow an attacker to execute arbitrary code on affected installations of DICOM Viewer. User interaction is required to exploit this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-163-01
CVE ID: CVE-2024-28878 State: PUBLISHED Published: 2024-04-12T15:21:10.963Z Last Updated: 2024-08-26T18:42:52.640Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: IOSiX Products: IO-1020 Micro ELD Problem Types: CWE-494 Description: IO-1020 Micro ELD downloads source code or an executable from an adjacent location and executes the code without sufficiently verifying the origin or integrity of the code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-093-01
CVE ID: CVE-2024-28880 State: PUBLISHED Published: 2024-05-27T23:50:58.229Z Last Updated: 2024-08-02T01:03:49.995Z Vendors: esMind, LLC Products: MosP kintai kanri Problem Types: Path traversal Description: Path traversal vulnerability in MosP kintai kanri V4.6.6 and earlier allows a remote attacker who can log in to the product to obtain sensitive information of the product. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.e-s-mind.com/2024-02-20/ - https://jvn.jp/en/jp/JVN97751842/
CVE ID: CVE-2024-28881 State: PUBLISHED Published: 2024-11-13T21:10:42.792Z Last Updated: 2024-11-14T19:42:47.555Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) Fortran Compiler Classic software Problem Types: escalation of privilege, CWE-427 Description: Uncontrolled search path for some Intel(R) Fortran Compiler Classic software before version 2021.13 may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01173.html
CVE ID: CVE-2024-28882 State: PUBLISHED Published: 2024-07-08T21:30:24.798Z Last Updated: 2024-11-01T20:38:32.966Z Vendors: OpenVPN Products: OpenVPN Problem Types: CWE-772 Description: OpenVPN from 2.6.0 through 2.6.10 in a server role accepts multiple exit notifications from authenticated clients which will extend the validity of a closing session Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://community.openvpn.net/openvpn/wiki/CVE-2024-28882 - https://www.mail-archive.com/openvpn-users@lists.sourceforge.net/msg07634.html
CVE ID: CVE-2024-28883 State: PUBLISHED Published: 2024-05-08T15:01:24.931Z Last Updated: 2024-08-02T01:03:50.247Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: F5 Products: BIG-IP Edge Client, BIG-IP Problem Types: CWE-346 Description: An origin validation vulnerability exists in BIG-IP APM browser network access VPN client for Windows, macOS and Linux which may allow an attacker to bypass F5 endpoint inspection. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Additional Analyst Notes: - ADP Container: - CVE Program Container: References: - https://my.f5.com/manage/s/article/K000138744
CVE ID: CVE-2024-28885 State: PUBLISHED Published: 2024-11-13T21:10:59.272Z Last Updated: 2024-11-14T19:40:52.914Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: n/a Products: Intel(R) QAT Engine for OpenSSL software Problem Types: information disclosure, CWE-203 Description: Observable discrepancy in some Intel(R) QAT Engine for OpenSSL software before version v1.6.1 may allow information disclosure via network access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01177.html
CVE ID: CVE-2024-28886 State: PUBLISHED Published: 2024-05-28T03:11:18.648Z Last Updated: 2024-08-02T01:03:50.258Z Vendors: ameya/ayame Products: UTAU Problem Types: OS command injection Description: OS command injection vulnerability exists in UTAU versions prior to v0.4.19. If a user of the product opens a crafted UTAU project file (.ust file), an arbitrary OS command may be executed. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://utau2008.xrea.jp/ - https://jvn.jp/en/jp/JVN71404925/
CVE ID: CVE-2024-28887 State: PUBLISHED Published: 2024-08-14T13:45:17.115Z Last Updated: 2024-08-14T16:17:22.424Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) IPP software Problem Types: escalation of privilege, CWE-427 Description: Uncontrolled search path in some Intel(R) IPP software before version 2021.11 may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01129.html
CVE ID: CVE-2024-28888 State: PUBLISHED Published: 2024-10-02T20:51:44.661Z Last Updated: 2025-09-23T14:17:01.678Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Foxit Products: Foxit Reader Problem Types: CWE-416 Description: A use-after-free vulnerability exists in the way Foxit Reader 2024.1.0.23997 handles a checkbox field object. A specially crafted Javascript code inside a malicious PDF document can trigger this vulnerability, which can lead to memory corruption and result in arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specia
r into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially crafted, malicious site if the browser plugin extension is enabled. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2024-1967 - https://www.foxit.com/support/security-bulletins.html
CVE ID: CVE-2024-28889 State: PUBLISHED Published: 2024-05-08T15:01:26.693Z Last Updated: 2024-08-02T01:03:50.257Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: F5 Products: BIG-IP Problem Types: CWE-825 Description: When an SSL profile with alert timeout is configured with a non-default value on a virtual server, undisclosed traffic along with conditions beyond the attacker's control can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://my.f5.com/manage/s/
d. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://my.f5.com/manage/s/article/K000138912
CVE ID: CVE-2024-28890 State: PUBLISHED Published: 2024-04-23T04:56:24.799Z Last Updated: 2024-11-18T21:11:06.673Z Vendors: WPMU DEV Products: Forminator Problem Types: Unrestricted Upload of File with Dangerous Type Description: Forminator prior to 1.29.0 contains an unrestricted upload of file with dangerous type vulnerability. If this vulnerability is exploited, a remote attacker may obtain sensitive information by accessing files on the server, alter the site that uses the plugin, and cause a denial-of-service (DoS) condition. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wordpress.org/plugins/forminator/ - https://wpmudev.com/ - https:
chment: - CVE Program Container: References: - https://wordpress.org/plugins/forminator/ - https://wpmudev.com/ - https://jvn.jp/en/jp/JVN50132400/
CVE ID: CVE-2024-28891 State: PUBLISHED Published: 2024-03-21T22:07:18.175Z Last Updated: 2024-08-12T20:09:47.869Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Delta Electronics Products: DIAEnergie Problem Types: CWE-89 Description: SQL injection vulnerability exists in the script Handler_CFG.ashx. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-074-12
CVE ID: CVE-2024-28892 State: PUBLISHED Published: 2024-11-21T14:41:53.406Z Last Updated: 2024-11-21T16:03:31.096Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: GoCast Products: GoCast Problem Types: CWE-78 Description: An OS command injection vulnerability exists in the name parameter of GoCast 1.1.3. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an unauthenticated HTTP request to trigger this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2024-1960
CVE ID: CVE-2024-28893 State: PUBLISHED Published: 2024-05-01T15:45:25.307Z Last Updated: 2025-03-27T15:08:57.666Z Vendors: HP Inc. Products: HP software packages (SoftPaqs) Description: Certain HP software packages (SoftPaqs) are potentially vulnerable to arbitrary code execution when the SoftPaq configuration file has been modified after extraction. HP has released updated software packages (SoftPaqs). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.hp.com/us-en/document/ish_10502451-10502508-16/hpsbhf03931
CVE ID: CVE-2024-28894 State: PUBLISHED Published: 2024-04-15T10:47:50.522Z Last Updated: 2024-08-02T01:03:50.255Z Vendors: DMG MORI Digital Co., LTD. and NEXT Co., Ltd. Products: Cente IPv6, Cente IPv6 SNMPv2, Cente IPv6 SNMPv3 Problem Types: Out-of-bounds read Description: Out-of-bounds read vulnerability caused by improper checking of the option length values in IPv6 headers exists in Cente middleware TCP/IP Network Series, which may allow an unauthenticated attacker to stop the device operations by sending a specially crafted packet. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.cente.jp/obstacle/4960/ - https://jvn.jp/en/vu/JVNVU94
Vulnrichment: - CVE Program Container: References: - https://www.cente.jp/obstacle/4960/ - https://jvn.jp/en/vu/JVNVU94016877/
CVE ID: CVE-2024-28895 State: PUBLISHED Published: 2024-04-01T00:16:08.562Z Last Updated: 2024-11-06T20:45:53.363Z Vendors: LY Corporation Products: 'Yahoo! JAPAN' App for Android, 'Yahoo! JAPAN' App for iOS Problem Types: Cross-site scripting (XSS) Description: 'Yahoo! JAPAN' App for Android v2.3.1 to v3.161.1 and 'Yahoo! JAPAN' App for iOS v3.2.2 to v4.109.0 contain a cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be executed on the WebView of 'Yahoo! JAPAN' App via other app installed on the user's device. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://jvn.jp/en/jp/JVN23528780/
CVE ID: CVE-2024-28896 State: PUBLISHED Published: 2024-04-09T17:00:18.742Z Last Updated: 2025-05-03T00:39:19.541Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 11 version 21H2, Windows 10 Version 21H2, Windows 11 version 22H2, Windows 10 Version 22H2, Windows 11 version 22H3, Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2012, Wind
Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: CWE-122 Description: Secure Boot Security Feature Bypass Vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-28896
CVE ID: CVE-2024-28897 State: PUBLISHED Published: 2024-04-09T17:01:09.527Z Last Updated: 2025-05-03T00:40:10.252Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 11 version 21H2, Windows 10 Version 21H2, Windows 11 version 22H2, Windows 10 Version 22H2, Windows 11 version 22H3, Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2012, Wi
7, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: CWE-20 Description: Secure Boot Security Feature Bypass Vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-28897
CVE ID: CVE-2024-28898 State: PUBLISHED Published: 2024-04-09T17:00:19.273Z Last Updated: 2025-05-03T00:39:20.099Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 11 version 21H2, Windows 10 Version 21H2, Windows 11 version 22H2, Windows 10 Version 22H2, Windows 11 version 22H3, Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2012, Wi
7, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: CWE-121 Description: Secure Boot Security Feature Bypass Vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-28898