Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-23764 State: PUBLISHED Published: 2024-02-08T00:00:00.000Z Last Updated: 2025-05-15T19:42:06.703Z Vendors: n/a Products: n/a Problem Types: n/a Description: Certain WithSecure products allow Local Privilege Escalation. This affects WithSecure Client Security 15 and later, WithSecure Server Security 15 and later, WithSecure Email and Server Security 15 and later, and WithSecure Elements Endpoint Protection 17 and later. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.withsecure.com/en/support/security-advisories - https://www.withsecure.com/en/support/security-advisories/cve-2024-23764
CVE ID: CVE-2024-23765 State: PUBLISHED Published: 2024-06-26T00:00:00 Last Updated: 2024-11-14T21:14:32.517Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on HMS Anybus X-Gateway AB7832-F 3 devices. The gateway exposes an unidentified service on port 7412 on the network. All the network services of the gateway become unresponsive after sending 85 requests to this port. The content and length of the frame does not matter. The device needs to be restarted to resume operations. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://sensepost.com/blog/2024/targeting-an-industrial-protocol-gateway/
CVE ID: CVE-2024-23766 State: PUBLISHED Published: 2024-06-26T00:00:00.000Z Last Updated: 2025-03-13T18:29:11.265Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on HMS Anybus X-Gateway AB7832-F 3 devices. The gateway exposes a web interface on port 80. An unauthenticated GET request to a specific URL triggers the reboot of the Anybus gateway (or at least most of its modules). An attacker can use this feature to carry out a denial of service attack by continuously sending GET requests to that URL. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://sensepost.com/blog/2024/targeting-an-industrial-protocol-gatewa
richment: - CVE Program Container: References: - https://sensepost.com/blog/2024/targeting-an-industrial-protocol-gateway/
CVE ID: CVE-2024-23767 State: PUBLISHED Published: 2024-06-26T00:00:00 Last Updated: 2024-08-01T23:13:07.335Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on HMS Anybus X-Gateway AB7832-F firmware version 3. The HICP protocol allows unauthenticated changes to a device's network configurations. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://sensepost.com/blog/2024/targeting-an-industrial-protocol-gateway/
CVE ID: CVE-2024-23768 State: PUBLISHED Published: 2024-01-22T00:00:00.000Z Last Updated: 2025-05-30T14:23:28.078Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:L/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: Dremio before 24.3.1 allows path traversal. An authenticated user who has no privileges on certain folders (and the files and datasets in these folders) can access these folders, files, and datasets. To be successful, the user must have access to the source and at least one folder in the source. Affected versions are: 24.0.0 through 24.3.0, 23.0.0 through 23.2.3, and 22.0.0 through 22.2.2. Fixed versions are: 24.3.1 and later, 23.2.4 and later, and 22
24.3.0, 23.0.0 through 23.2.3, and 22.0.0 through 22.2.2. Fixed versions are: 24.3.1 and later, 23.2.4 and later, and 22.2.3 and later. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://docs.dremio.com/current/reference/bulletins/2024-01-12-01
CVE ID: CVE-2024-23769 State: PUBLISHED Published: 2024-02-07T00:00:00.000Z Last Updated: 2025-05-15T19:43:11.273Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AC:L/AV:L/A:H/C:H/I:H/PR:L/S:U/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: Improper privilege control for the named pipe in Samsung Magician PC Software 8.0.0 (for Windows) allows a local attacker to read privileged data. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://semiconductor.samsung.com/support/quality-support/product-security-updates/
CVE ID: CVE-2024-23770 State: PUBLISHED Published: 2024-01-22T00:00:00.000Z Last Updated: 2025-05-30T14:23:22.098Z Vendors: n/a Products: n/a Problem Types: n/a Description: darkhttpd through 1.15 allows local users to discover credentials (for --auth) by listing processes and their arguments. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/emikulic/darkhttpd/commit/2b339828b2a42a5fda105ea84934957a7d23e35d - https://github.com/emikulic/darkhttpd/compare/v1.14...v1.15 - http://www.openwall.com/lists/oss-security/2024/01/25/1
CVE ID: CVE-2024-23771 State: PUBLISHED Published: 2024-01-22T00:00:00.000Z Last Updated: 2025-05-30T14:23:16.116Z Vendors: n/a Products: n/a Problem Types: n/a Description: darkhttpd before 1.15 uses strcmp (which is not constant time) to verify authentication, which makes it easier for remote attackers to bypass authentication via a timing side channel. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/emikulic/darkhttpd/compare/v1.14...v1.15 - https://github.com/emikulic/darkhttpd/commit/f477619d49f3c4de9ad59bd194265a48ddc03f04 - http://www.openwall.com/lists/oss-security/2024/01/25/1
CVE ID: CVE-2024-23772 State: PUBLISHED Published: 2024-04-30T00:00:00 Last Updated: 2024-08-09T20:52:13.632Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Quest KACE Agent for Windows 12.0.38 and 13.1.23.0. An Arbitrary file create vulnerability exists in the KSchedulerSvc.exe, KUserAlert.exe, and Runkbot.exe components. This allows local attackers to create any file of their choice with NT Authority\SYSTEM privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.quest.com/kace/ - https://support.quest.com/kb/4375402/quest-response-to-kace-sma-agent-vulnerabilities-cve-2024-23772-cve-2024-23773-
/ - https://support.quest.com/kb/4375402/quest-response-to-kace-sma-agent-vulnerabilities-cve-2024-23772-cve-2024-23773-cve-2024-23774
CVE ID: CVE-2024-23773 State: PUBLISHED Published: 2024-04-30T00:00:00 Last Updated: 2024-08-01T23:13:07.566Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Quest KACE Agent for Windows 12.0.38 and 13.1.23.0. An Arbitrary file delete vulnerability exists in the KSchedulerSvc.exe component. Local attackers can delete any file of their choice with NT Authority\SYSTEM privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.quest.com/kace/ - https://support.quest.com/kb/4375402/quest-response-to-kace-sma-agent-vulnerabilities-cve-2024-23772-cve-2024-23773-cve-2024-23774
CVE ID: CVE-2024-23774 State: PUBLISHED Published: 2024-04-30T00:00:00 Last Updated: 2024-08-01T23:13:07.423Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Quest KACE Agent for Windows 12.0.38 and 13.1.23.0. An unquoted Windows search path vulnerability exists in the KSchedulerSvc.exe and AMPTools.exe components. This allows local attackers to execute code of their choice with NT Authority\SYSTEM privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.quest.com/kace/ - https://support.quest.com/kb/4375402/quest-response-to-kace-sma-agent-vulnerabilities-cve-2024-23772-cve-2024-23773-cve-2024-237
support.quest.com/kb/4375402/quest-response-to-kace-sma-agent-vulnerabilities-cve-2024-23772-cve-2024-23773-cve-2024-23774
CVE ID: CVE-2024-23775 State: PUBLISHED Published: 2024-01-31T00:00:00.000Z Last Updated: 2025-11-04T18:28:52.332Z Vendors: n/a Products: n/a Problem Types: n/a Description: Integer Overflow vulnerability in Mbed TLS 2.x before 2.28.7 and 3.x before 3.5.2, allows attackers to cause a denial of service (DoS) via mbedtls_x509_set_extension(). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2024-01-2/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IIBPEYSVRK4IFLBSYJAWKH33YBNH5HR2/ - https://lists.fedoraproject.org/a
package-announce%40lists.fedoraproject.org/message/IIBPEYSVRK4IFLBSYJAWKH33YBNH5HR2/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GP5UU7Z6LJNBLBT4SC5WWS2HDNMTFZH5/
CVE ID: CVE-2024-23782 State: PUBLISHED Published: 2024-01-28T23:09:13.092Z Last Updated: 2025-06-02T19:47:56.058Z Vendors: appleple inc. Products: a-blog cms Ver.3.1.x series, a-blog cms Ver.3.0.x series, a-blog cms Ver.2.11.x series, a-blog cms Ver.2.10.x series, a-blog cms Problem Types: Cross-site scripting (XSS) Description: Cross-site scripting vulnerability exists in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.7, Ver.3.0.x series versions prior to Ver.3.0.29, Ver.2.11.x series versions prior to Ver.2.11.58, Ver.2.10.x series versions prior to Ver.2.10.50, and Ver.2.9.0 and earlier versions. If this vulnerability is exploited, a user with a contributor or higher privilege may
nd Ver.2.9.0 and earlier versions. If this vulnerability is exploited, a user with a contributor or higher privilege may execute an arbitrary script on the web browser of the user who accessed the website using the product. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://developer.a-blogcms.jp/blog/news/JVN-34565930.html - https://jvn.jp/en/jp/JVN34565930/
CVE ID: CVE-2024-23783 State: PUBLISHED Published: 2024-02-14T10:02:32.489Z Last Updated: 2025-03-25T16:30:44.982Z Vendors: SHARP CORPORATION Products: Energy Management Controller with Cloud Services Problem Types: Improper authentication Description: Improper authentication vulnerability in Energy Management Controller with Cloud Services JH-RVB1 /JH-RV11 Ver.B0.1.9.1 and earlier allows a network-adjacent unauthenticated attacker to access the affected product without authentication. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jp.sharp/support/taiyo/info/JVNVU94591337_en.pdf - https://jp.sharp/support/taiyo/info/JVNVU94591337_jp.pdf - h
https://jp.sharp/support/taiyo/info/JVNVU94591337_en.pdf - https://jp.sharp/support/taiyo/info/JVNVU94591337_jp.pdf - https://jvn.jp/en/vu/JVNVU94591337/
CVE ID: CVE-2024-23784 State: PUBLISHED Published: 2024-02-14T10:05:55.231Z Last Updated: 2025-03-25T16:30:47.644Z Vendors: SHARP CORPORATION Products: Energy Management Controller with Cloud Services Problem Types: Improper access control Description: Improper access control vulnerability exists in Energy Management Controller with Cloud Services JH-RVB1 /JH-RV11 Ver.B0.1.9.1 and earlier, which may allow a network-adjacent unauthenticated attacker to obtain a username and its hashed password displayed on the management page of the affected product. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jp.sharp/support/taiyo/info/JVNVU94591337_en.p
: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jp.sharp/support/taiyo/info/JVNVU94591337_en.pdf - https://jp.sharp/support/taiyo/info/JVNVU94591337_jp.pdf - https://jvn.jp/en/vu/JVNVU94591337/
CVE ID: CVE-2024-23785 State: PUBLISHED Published: 2024-02-14T10:07:11.603Z Last Updated: 2024-10-27T13:26:42.677Z Vendors: SHARP CORPORATION Products: Energy Management Controller with Cloud Services Problem Types: Cross-site request forgery (CSRF) Description: Cross-site request forgery vulnerability in Energy Management Controller with Cloud Services JH-RVB1 /JH-RV11 Ver.B0.1.9.1 and earlier allows a remote unauthenticated attacker to change the product settings. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jp.sharp/support/taiyo/info/JVNVU94591337_en.pdf - https://jp.sharp/support/taiyo/info/JVNVU94591337_jp.pdf - https://jvn.jp/en/vu/
pport/taiyo/info/JVNVU94591337_en.pdf - https://jp.sharp/support/taiyo/info/JVNVU94591337_jp.pdf - https://jvn.jp/en/vu/JVNVU94591337/
CVE ID: CVE-2024-23786 State: PUBLISHED Published: 2024-02-14T10:08:32.703Z Last Updated: 2025-03-18T13:46:50.475Z Vendors: SHARP CORPORATION Products: Energy Management Controller with Cloud Services Problem Types: Cross-site scripting (XSS) Description: Cross-site scripting vulnerability in Energy Management Controller with Cloud Services JH-RVB1 /JH-RV11 Ver.B0.1.9.1 and earlier allows a network-adjacent unauthenticated attacker to execute an arbitrary script on the web browser of the user who is accessing the management page of the affected product. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jp.sharp/support/taiyo/info/JVNVU94591337_
otes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jp.sharp/support/taiyo/info/JVNVU94591337_en.pdf - https://jp.sharp/support/taiyo/info/JVNVU94591337_jp.pdf - https://jvn.jp/en/vu/JVNVU94591337/
CVE ID: CVE-2024-23787 State: PUBLISHED Published: 2024-02-14T10:09:45.961Z Last Updated: 2024-08-13T13:45:10.944Z Vendors: SHARP CORPORATION Products: Energy Management Controller with Cloud Services Problem Types: Path traversal Description: Path traversal vulnerability in Energy Management Controller with Cloud Services JH-RVB1 /JH-RV11 Ver.B0.1.9.1 and earlier allows a network-adjacent unauthenticated attacker to obtain an arbitrary file in the affected product. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jp.sharp/support/taiyo/info/JVNVU94591337_en.pdf - https://jp.sharp/support/taiyo/info/JVNVU94591337_jp.pdf - https://jvn.jp/en/vu/
CVE ID: CVE-2024-23788 State: PUBLISHED Published: 2024-02-14T10:10:41.448Z Last Updated: 2025-03-19T13:44:59.100Z Vendors: SHARP CORPORATION Products: Energy Management Controller with Cloud Services Problem Types: Server-Side Request Forgery (SSRF) Description: Server-side request forgery vulnerability in Energy Management Controller with Cloud Services JH-RVB1 /JH-RV11 Ver.B0.1.9.1 and earlier allows a network-adjacent unauthenticated attacker to send an arbitrary HTTP request (GET) from the affected product. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jp.sharp/support/taiyo/info/JVNVU94591337_en.pdf - https://jp.sharp/support/taiyo/in
Vulnrichment: References: - https://jp.sharp/support/taiyo/info/JVNVU94591337_en.pdf - https://jp.sharp/support/taiyo/info/JVNVU94591337_jp.pdf - https://jvn.jp/en/vu/JVNVU94591337/
CVE ID: CVE-2024-23789 State: PUBLISHED Published: 2024-02-14T10:35:11.140Z Last Updated: 2024-08-14T19:04:41.960Z Vendors: SHARP CORPORATION Products: Energy Management Controller with Cloud Services Problem Types: OS command injection Description: Energy Management Controller with Cloud Services JH-RVB1 /JH-RV11 Ver.B0.1.9.1 and earlier allows a network-adjacent unauthenticated attacker to execute an arbitrary OS command on the affected product. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jp.sharp/support/taiyo/info/JVNVU94591337_en.pdf - https://jp.sharp/support/taiyo/info/JVNVU94591337_jp.pdf - https://jvn.jp/en/vu/JVNVU94591337/
CVE ID: CVE-2024-23790 State: PUBLISHED Published: 2024-01-29T09:21:14.996Z Last Updated: 2025-06-17T21:29:17.700Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N) Vendors: OTRS AG Products: OTRS Problem Types: CWE-20 Description: Improper Input Validation vulnerability in the upload functionality for user avatars allows functionality misuse due to missing check of filetypes. This issue affects OTRS: from 7.0.X through 7.0.48, from 8.0.X through 8.0.37, from 2023 through 2023.1.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://otrs.com/release-notes/otrs-security-advisory-2024-01/
CVE ID: CVE-2024-23791 State: PUBLISHED Published: 2024-01-29T09:21:00.278Z Last Updated: 2025-05-29T15:10:14.868Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: OTRS AG Products: OTRS Problem Types: CWE-532 Description: Insertion of debug information into log file during building the elastic search index allows reading of sensitive information from articles.This issue affects OTRS: from 7.0.X through 7.0.48, from 8.0.X through 8.0.37, from 2023.X through 2023.1.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://otrs.com/release-notes/otrs-security-advisory-2024-02/
CVE ID: CVE-2024-23792 State: PUBLISHED Published: 2024-01-29T09:20:06.829Z Last Updated: 2024-11-12T21:47:04.433Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: OTRS AG Products: OTRS Problem Types: CWE-287 Description: When adding attachments to ticket comments, another user can add attachments as well impersonating the orginal user. The attack requires a logged-in other user to know the UUID. While the legitimate user completes the comment, the malicious user can add more files to the comment. This issue affects OTRS: from 7.0.X through 7.0.48, from 8.0.X through 8.0.37, from 2023.X through 2023.1.1. Additional Analyst Notes: - CVE Program Container: - C
7.0.48, from 8.0.X through 8.0.37, from 2023.X through 2023.1.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://otrs.com/release-notes/otrs-security-advisory-2024-03/
CVE ID: CVE-2024-23793 State: PUBLISHED Published: 2024-06-06T18:06:58.805Z Last Updated: 2024-08-01T23:13:07.327Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:L) Vendors: OTRS AG Products: OTRS, ((OTRS)) Community Edition Problem Types: CWE-22 Description: The file upload feature in OTRS and ((OTRS)) Community Edition has a path traversal vulnerability. This issue permits authenticated agents or customer users to upload potentially harmful files to directories accessible by the web server, potentially leading to the execution of local code like Perl scripts. This issue affects OTRS: from 7.0.X through 7.0.49, 8.0.X, 2023.X, from 2024.X through 2024.3.2; ((OTRS)) Com
l scripts. This issue affects OTRS: from 7.0.X through 7.0.49, 8.0.X, 2023.X, from 2024.X through 2024.3.2; ((OTRS)) Community Edition: from 6.0.1 through 6.0.34. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://otrs.com/release-notes/otrs-security-advisory-2024-05/
CVE ID: CVE-2024-23794 State: PUBLISHED Published: 2024-07-15T07:14:09.557Z Last Updated: 2024-08-01T23:13:07.432Z Severity: MEDIUM (CVSS 5.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:N) Vendors: OTRS AG Products: OTRS Problem Types: CWE-266 Description: An incorrect privilege assignment vulnerability in the inline editing functionality of OTRS can lead to privilege escalation. This flaw allows an agent with read-only permissions to gain full access to a ticket. This issue arises in very rare instances when an admin has previously enabled the setting 'RequiredLock' of 'AgentFrontend::Ticket::InlineEditing::Property###Watch' in the system configuration.This issue affects OTRS: * 8.0.X * 2023
ntFrontend::Ticket::InlineEditing::Property###Watch' in the system configuration.This issue affects OTRS: * 8.0.X * 2023.X * from 2024.X through 2024.4.x Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://otrs.com/release-notes/otrs-security-advisory-2024-06/
CVE ID: CVE-2024-23795 State: PUBLISHED Published: 2024-02-13T09:00:09.340Z Last Updated: 2025-05-09T18:26:57.002Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: Tecnomatix Plant Simulation V2201, Tecnomatix Plant Simulation V2302 Problem Types: CWE-787 Description: A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions < V2201.0012), Tecnomatix Plant Simulation V2302 (All versions < V2302.0006). The affected application contains an out of bounds write past the end of an allocated buffer while parsing a specially crafted WRL file. This could allow an attacker to execute code in the context of the
ed buffer while parsing a specially crafted WRL file. This could allow an attacker to execute code in the context of the current process. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-017796.html
CVE ID: CVE-2024-23796 State: PUBLISHED Published: 2024-02-13T09:00:10.640Z Last Updated: 2024-08-27T14:29:39.509Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: Tecnomatix Plant Simulation V2201, Tecnomatix Plant Simulation V2302 Problem Types: CWE-122 Description: A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions < V2201.0012), Tecnomatix Plant Simulation V2302 (All versions < V2302.0006). The affected application is vulnerable to heap-based buffer overflow while parsing specially crafted WRL files. This could allow an attacker to execute code in the context of the current process. Additio
specially crafted WRL files. This could allow an attacker to execute code in the context of the current process. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-017796.html
CVE ID: CVE-2024-23797 State: PUBLISHED Published: 2024-02-13T09:00:12.025Z Last Updated: 2024-08-16T19:16:15.675Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: Tecnomatix Plant Simulation V2201, Tecnomatix Plant Simulation V2302 Problem Types: CWE-121 Description: A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions < V2201.0012), Tecnomatix Plant Simulation V2302 (All versions < V2302.0006). The affected applications contain a stack overflow vulnerability while parsing specially crafted WRL files. This could allow an attacker to execute code in the context of the current process. Additional
ially crafted WRL files. This could allow an attacker to execute code in the context of the current process. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-017796.html
CVE ID: CVE-2024-23798 State: PUBLISHED Published: 2024-02-13T09:00:13.285Z Last Updated: 2024-11-07T19:09:02.557Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: Tecnomatix Plant Simulation V2201, Tecnomatix Plant Simulation V2302 Problem Types: CWE-121 Description: A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions < V2201.0012), Tecnomatix Plant Simulation V2302 (All versions < V2302.0006). The affected applications contain a stack overflow vulnerability while parsing specially crafted WRL files. This could allow an attacker to execute code in the context of the current process. Additional
CVE ID: CVE-2024-23799 State: PUBLISHED Published: 2024-02-13T09:00:14.553Z Last Updated: 2024-08-01T23:13:08.426Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C) Vendors: Siemens Products: Tecnomatix Plant Simulation V2201, Tecnomatix Plant Simulation V2302 Problem Types: CWE-476 Description: A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions), Tecnomatix Plant Simulation V2302 (All versions < V2302.0007). The affected applications contain a null pointer dereference vulnerability while parsing specially crafted SPP files. An attacker could leverage this vulnerability to crash the application causing denial of service co