Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-41159 State: PUBLISHED Published: 2024-12-18T22:39:10.003Z Last Updated: 2024-12-20T17:31:52.560Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: Microsoft Products: OneNote Problem Types: CWE-347 Description: A library injection vulnerability exists in Microsoft OneNote 16.83 for macOS. A specially crafted library can leverage OneNote's access privileges, leading to a permission bypass. A malicious application could inject a library and start the program to trigger this vulnerability and then make use of the vulnerable application's permissions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://
cation's permissions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2024-1975
CVE ID: CVE-2024-41160 State: PUBLISHED Published: 2024-09-02T03:25:21.861Z Last Updated: 2024-09-03T14:50:58.644Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: OpenHarmony Products: OpenHarmony Problem Types: CWE-416 Description: in OpenHarmony v4.1.0 and prior versions allow a local attacker cause the common permission is upgraded to root and sensitive information leak through use after free. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2024/2024-09.md
CVE ID: CVE-2024-41161 State: PUBLISHED Published: 2024-08-08T17:49:35.888Z Last Updated: 2024-08-09T14:37:54.073Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Vonets Products: VAR1200-H, VAR1200-L, VAR600-H, VAP11AC, VAP11G-500S, VBG1200, VAP11S-5G, VAP11S, VAR11N-300, VAP11G-300, VAP11N-300, VAP11G, VAP11G-500, VGA-1000 Problem Types: CWE-798 Description: Use of hard-coded credentials vulnerability affecting Vonets industrial wifi bridge relays and wifi bridge repeaters, software versions 3.3.23.6.9 and prior, enables an unauthenticated remote attacker to bypass authentication using hard-coded administrator credentials. These accounts cannot be disabled.
remote attacker to bypass authentication using hard-coded administrator credentials. These accounts cannot be disabled. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-214-08
CVE ID: CVE-2024-41162 State: PUBLISHED Published: 2024-08-01T14:05:09.501Z Last Updated: 2024-08-02T15:01:29.868Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:N) Vendors: Mattermost Products: Mattermost Problem Types: CWE-284 Description: Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5 and 9.8.x <= 9.8.1 fail to disallow the modification of local channels by a remote, when shared channels are enabled, which allows a malicious remote to make an arbitrary local channel read-only. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2024-41163 State: PUBLISHED Published: 2024-10-03T15:16:10.932Z Last Updated: 2024-12-18T14:31:47.613Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Veertu Products: Anka Build Problem Types: CWE-22 Description: A directory traversal vulnerability exists in the archive functionality of Veertu Anka Build 1.42.0. A specially crafted HTTP request can lead to a disclosure of sensitive information. An attacker can make an unauthenticated HTTP request to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2024-2059
CVE ID: CVE-2024-41164 State: PUBLISHED Published: 2024-08-14T14:32:31.623Z Last Updated: 2024-08-14T14:53:16.759Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: F5 Products: BIG-IP, BIG-IP Next CNF, BIG-IP Next SPK Problem Types: CWE-476 Description: When TCP profile with Multipath TCP enabled (MPTCP) is configured on a Virtual Server, undisclosed traffic along with conditions beyond the attackers control can cause TMM to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://my.f5.com/manage/s/article/K000138477
CVE ID: CVE-2024-41165 State: PUBLISHED Published: 2024-12-18T22:39:44.528Z Last Updated: 2024-12-20T17:32:16.315Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: Microsoft Products: Word Problem Types: CWE-347 Description: A library injection vulnerability exists in Microsoft Word 16.83 for macOS. A specially crafted library can leverage Word's access privileges, leading to a permission bypass. A malicious application could inject a library and start the program to trigger this vulnerability and then make use of the vulnerable application's permissions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosinte
permissions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2024-1977
CVE ID: CVE-2024-41166 State: PUBLISHED Published: 2025-02-12T21:20:07.730Z Last Updated: 2025-02-13T19:46:54.348Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H) Vendors: n/a Products: Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi software for Windows Problem Types: Denial of Service, CWE-121 Description: Stack-based buffer overflow in some Intel(R) PROSet/Wireless WiFi and Killerâ„¢ WiFi software for Windows before version 23.80 may allow an unauthenticated user to potentially enable denial of service via adjacent access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01224.
tes: - CISA ADP Vulnrichment: References: - https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01224.html
CVE ID: CVE-2024-41167 State: PUBLISHED Published: 2024-11-13T21:10:47.672Z Last Updated: 2024-11-14T19:42:21.910Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) Server Board M10JNP2SB Family Problem Types: escalation of privilege, CWE-20 Description: Improper input validation in UEFI firmware in some Intel(R) Server Board M10JNP2SB Family may allow a privileged user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01175.html
CVE ID: CVE-2024-41168 State: PUBLISHED Published: 2025-02-12T21:58:41.096Z Last Updated: 2025-02-18T19:53:58.563Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) Vendors: n/a Products: Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi software for Windows Problem Types: Denial of Service, CWE-416 Description: Use after free in some Intel(R) PROSet/Wireless WiFi and Killerâ„¢ WiFi software for Windows before version 23.80 may allow an unauthenticated user to potentially enable denial of service via adjacent access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01224.html
CVE ID: CVE-2024-41169 State: PUBLISHED Published: 2025-07-12T16:22:35.724Z Last Updated: 2025-11-04T21:08:42.107Z Vendors: Apache Software Foundation Products: Apache Zeppelin Problem Types: CWE-664 Description: The attacker can use the raft server protocol in an unauthenticated way. The attacker can see the server's resources, including directories and files. This issue affects Apache Zeppelin: from 0.10.1 up to 0.12.0. Users are recommended to upgrade to version 0.12.0, which fixes the issue by removing the Cluster Interpreter. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/apache/zeppelin/pull/4841 - https://issues.apache.org/
chment: - CVE Program Container: References: - https://github.com/apache/zeppelin/pull/4841 - https://issues.apache.org/jira/browse/ZEPPELIN-6101 - https://lists.apache.org/thread/moyym04993c8owh4h0qj98r43tbo8qdd
CVE ID: CVE-2024-41170 State: PUBLISHED Published: 2024-09-10T09:36:44.999Z Last Updated: 2024-09-10T15:08:25.467Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Siemens Products: Tecnomatix Plant Simulation V2302, Tecnomatix Plant Simulation V2404 Problem Types: CWE-121 Description: A vulnerability has been identified in Tecnomatix Plant Simulation V2302 (All versions < V2302.0015), Tecnomatix Plant Simulation V2404 (All versions < V2404.0004). The affected applications contain a stack based overflow vulnerability while parsing specially crafted SPP files. This could allow an attacker to execute code in the context of the current process. Additional Analyst
afted SPP files. This could allow an attacker to execute code in the context of the current process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-427715.html
CVE ID: CVE-2024-41171 State: PUBLISHED Published: 2024-09-10T09:36:46.244Z Last Updated: 2024-09-10T15:03:16.367Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: SINUMERIK 828D V4, SINUMERIK 828D V5, SINUMERIK 840D sl V4, SINUMERIK ONE Problem Types: CWE-732 Description: A vulnerability has been identified in SINUMERIK 828D V4 (All versions), SINUMERIK 828D V5 (All versions < V5.24), SINUMERIK 840D sl V4 (All versions), SINUMERIK ONE (All versions < V6.24). Affected devices do not properly enforce access restrictions to scripts that are regularly executed by the system with elevated privileges. This could allow an authenticated
ictions to scripts that are regularly executed by the system with elevated privileges. This could allow an authenticated local attacker to escalate their privileges in the underlying system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-342438.html
CVE ID: CVE-2024-41172 State: PUBLISHED Published: 2024-07-19T08:50:43.766Z Last Updated: 2024-09-13T17:05:12.209Z Vendors: Apache Software Foundation Products: Apache CXF Problem Types: CWE-401 Description: In versions of Apache CXF before 3.6.4 and 4.0.5 (3.5.x and lower versions are not impacted), a CXF HTTP client conduit may prevent HTTPClient instances from being garbage collected and it is possible that memory consumption will continue to increase, eventually causing the application to run out of memory Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lists.apache.org/thread/n2hvbrgwpdtcqdccod8by28ynnolybl6
CVE ID: CVE-2024-41173 State: PUBLISHED Published: 2024-08-27T08:00:47.054Z Last Updated: 2024-08-27T13:07:46.907Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Beckhoff Products: IPC Diagnostics package, TwinCAT/BSD Problem Types: CWE-288 Description: The IPC-Diagnostics package included in TwinCAT/BSD is vulnerable to a local authentication bypass by a low privileged attacker. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.vde.com/en/advisories/VDE-2024-045
CVE ID: CVE-2024-41174 State: PUBLISHED Published: 2024-08-27T08:01:09.810Z Last Updated: 2024-08-27T17:48:58.704Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Beckhoff Products: IPC Diagnostics package, TwinCAT/BSD Problem Types: CWE-79 Description: The IPC-Diagnostics package in TwinCAT/BSD is susceptible to improper input neutralization by a low-privileged local attacker. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.vde.com/en/advisories/VDE-2024-048
CVE ID: CVE-2024-41175 State: PUBLISHED Published: 2024-08-27T08:01:31.499Z Last Updated: 2024-08-27T13:47:06.701Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Beckhoff Products: IPC Diagnostics package, TwinCAT/BSD Problem Types: CWE-770 Description: The IPC-Diagnostics package included in TwinCAT/BSD is vulnerable to a local denial-of-service attack by a low privileged attacker. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.vde.com/en/advisories/VDE-2024-049/ - https://infosys.beckhoff.com/content/1033/twincat_bsd/11780818443.html?id=4222392218353411614
CVE ID: CVE-2024-41176 State: PUBLISHED Published: 2024-08-27T08:01:57.443Z Last Updated: 2024-10-01T06:39:04.136Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L) Vendors: Beckhoff Products: MDP package, TwinCAT/BSD Problem Types: CWE-120 Description: The MPD package included in TwinCAT/BSD allows an authenticated, low-privileged local attacker to induce a Denial-of-Service (DoS) condition on the daemon and execute code in the context of user “root” via a crafted HTTP request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.vde.com/en/advisories/VDE-2024-050
CVE ID: CVE-2024-41177 State: PUBLISHED Published: 2025-08-03T10:09:43.302Z Last Updated: 2025-11-04T21:08:43.404Z Vendors: Apache Software Foundation Products: Apache Zeppelin Problem Types: CWE-79 Description: Incomplete Blacklist to Cross-Site Scripting vulnerability in Apache Zeppelin. This issue affects Apache Zeppelin: before 0.12.0. Users are recommended to upgrade to version 0.12.0, which fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/apache/zeppelin/pull/4755 - https://github.com/apache/zeppelin/pull/4795 - https://lists.apache.org/thread/nwh8vh9f3pnvt04n8z4g2kbddh62blr6
CVE ID: CVE-2024-41178 State: PUBLISHED Published: 2024-07-23T16:50:10.093Z Last Updated: 2024-08-13T20:31:54.957Z Vendors: Apache Software Foundation Products: Apache Arrow Rust Object Store Problem Types: CWE-532 Description: Exposure of temporary credentials in logs in Apache Arrow Rust Object Store (`object_store` crate), version 0.10.1 and earlier on all platforms using AWS WebIdentityTokens. On certain error conditions, the logs may contain the OIDC token passed to AssumeRoleWithWebIdentity https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRoleWithWebIdentity.html . This allows someone with access to the logs to impersonate that identity, including performing their own call
ity.html . This allows someone with access to the logs to impersonate that identity, including performing their own calls to AssumeRoleWithWebIdentity, until the OIDC token expires. Typically OIDC tokens are valid for up to an hour, although this will vary depending on the issuer. Users are recommended to use a different AWS authentication mechanism, disable logging or upgrade to version 0.10.2, which fixes this issue. Details: When using AWS WebIdentityTokens with the object_store crate, in the event of a failure and automatic retry, the underlying reqwest error, including the full URL with the credentials, potentially in the parameters, is written to the logs. Thanks to Paul Hatcherian for
the full URL with the credentials, potentially in the parameters, is written to the logs. Thanks to Paul Hatcherian for reporting this vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lists.apache.org/thread/3t0povdppnt2czv6crlsqhvyko93kcrg - http://www.openwall.com/lists/oss-security/2024/07/23/3
CVE ID: CVE-2024-41183 State: PUBLISHED Published: 2024-10-22T18:26:51.474Z Last Updated: 2025-03-13T16:17:49.174Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Trend Micro, Inc. Products: Trend Micro VPN (consumer) Description: Trend Micro VPN, version 5.8.1012 and below is vulnerable to an arbitrary file overwrite under specific conditions that can lead to elevation of privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpcenter.trendmicro.com/en-us/article/tmka-14460 - https://www.zerodayinitiative.com/advisories/ZDI-24-1023/ - https://www.zerodayinitiative.com/advisories/ZDI-24-1022/
CVE ID: CVE-2024-41184 State: PUBLISHED Published: 2024-07-18T00:00:00 Last Updated: 2024-08-02T04:46:51.612Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the vrrp_ipsets_handler handler (fglobal_parser.c) of keepalived through 2.3.1, an integer overflow can occur. NOTE: this CVE Record might not be worthwhile because an empty ipset name must be configured by the user. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/acassen/keepalived/issues/2447#issuecomment-2231329734
CVE ID: CVE-2024-41195 State: PUBLISHED Published: 2025-05-22T00:00:00.000Z Last Updated: 2025-05-23T15:51:04.869Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Ocuco Innovation - INNOVASERVICEINTF.EXE v2.10.24.17 allows attackers to bypass authentication and escalate privileges to Administrator via a crafted TCP packet. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://drive.google.com/file/d/1U50ZsLo7VXWKQ1_6FxWy70F_75jzVUwi/view?usp=drive_link - https://gist.githubusercontent.com/john0x186/1d9cc7fcc8386480d2bdaa9fdcfa914b/raw/d2d3d74ccaa939127ee2b03139061509a7dd238c/full-disclosure.md
CVE ID: CVE-2024-41196 State: PUBLISHED Published: 2025-05-22T00:00:00.000Z Last Updated: 2025-05-23T15:46:15.731Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Ocuco Innovation - REPORTSERVER.EXE v2.10.24.13 allows attackers to bypass authentication and escalate privileges to Administrator via a crafted TCP packet. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cwe.mitre.org/data/definitions/285.html - https://drive.google.com/file/d/1UqJAQiwhHZCHtgac4-YiJHElBYhqUu3M/view?usp=drive_link - https://gist.githubusercontent.com/john0x186/1d9cc7fcc8386480d2bdaa9fdcfa914b/raw/d2d3d74ccaa939127ee2b03139061509a7dd238c/full-disclosure.md
CVE ID: CVE-2024-41197 State: PUBLISHED Published: 2025-05-22T00:00:00.000Z Last Updated: 2025-05-23T15:44:56.555Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Ocuco Innovation - INVCLIENT.EXE v2.10.24.5 allows attackers to bypass authentication and escalate privileges to Administrator via a crafted TCP packet. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://drive.google.com/file/d/1XgbcJqYIHxAROcCACdgdD8V_97Hcwdze/view?usp=drive_link - https://gist.githubusercontent.com/john0x186/1d9cc7fcc8386480d2bdaa9fdcfa914b/raw/d2d3d74ccaa939127ee2b03139061509a7dd238c/full-disclosure.md
CVE ID: CVE-2024-41198 State: PUBLISHED Published: 2025-05-22T00:00:00.000Z Last Updated: 2025-05-23T15:43:08.302Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Ocuco Innovation - REPORTS.EXE v2.10.24.13 allows attackers to bypass authentication and escalate privileges to Administrator via a crafted TCP packet. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://drive.google.com/file/d/1k7P36ygRjQE6XfcT-FJgsN2yrtQy2yhH/view?usp=drive_link - https://gist.githubusercontent.com/john0x186/1d9cc7fcc8386480d2bdaa9fdcfa914b/raw/d2d3d74ccaa939127ee2b03139061509a7dd238c/full-disclosure.md
CVE ID: CVE-2024-41199 State: PUBLISHED Published: 2025-05-22T00:00:00.000Z Last Updated: 2025-05-22T19:39:48.750Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Ocuco Innovation - JOBMANAGER.EXE v2.10.24.16 allows attackers to bypass authentication and escalate privileges to Administrator via a crafted TCP packet. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://drive.google.com/file/d/1dVvH9l0gKRK0OPcF6_8yTLPsARKFqWqB/view?usp=drive_link - https://gist.githubusercontent.com/john0x186/1d9cc7fcc8386480d2bdaa9fdcfa914b/raw/d2d3d74ccaa939127ee2b03139061509a7dd238c/full-disclosure.md
CVE ID: CVE-2024-41200 State: PUBLISHED Published: 2024-08-05T00:00:00 Last Updated: 2024-11-05T21:22:22.703Z Vendors: n/a Products: n/a Problem Types: n/a Description: A segmentation fault in KMPlayer v4.2.2.65 allows attackers to cause a Denial of Service (DoS) via a crafted AVI file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gist.github.com/SecZone-SFuzz/3cf2d8b50ffe4b4951c193d8c0cd65a9
CVE ID: CVE-2024-41206 State: PUBLISHED Published: 2024-11-14T00:00:00 Last Updated: 2024-11-15T18:18:19.607Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stack-based buffer over-read in tsMuxer version nightly-2024-03-14-01-51-12 allows attackers to cause Information Disclosure via a crafted TS video file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/justdan96/tsMuxer/issues/859
CVE ID: CVE-2024-41209 State: PUBLISHED Published: 2024-11-14T00:00:00 Last Updated: 2024-11-15T18:15:53.492Z Vendors: n/a Products: n/a Problem Types: n/a Description: A heap-based buffer overflow in tsMuxer version nightly-2024-03-14-01-51-12 allows attackers to cause Denial of Service (DoS) and Code Execution via a crafted MOV video file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/justdan96/tsMuxer/issues/841 - https://ricercasecurity.blogspot.com/2024/10/rezzuf0-day-cve-2024-41209.html
CVE ID: CVE-2024-41217 State: PUBLISHED Published: 2024-11-14T00:00:00 Last Updated: 2024-11-15T18:17:00.971Z Vendors: n/a Products: n/a Problem Types: n/a Description: A heap-based buffer overflow in tsMuxer version nightly-2024-05-10-02-00-45 allows attackers to cause Denial of Service (DoS) via a crafted MKV video file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/justdan96/tsMuxer/issues/846
CVE ID: CVE-2024-41226 State: PUBLISHED Published: 2024-08-06T00:00:00 Last Updated: 2024-09-03T21:02:39.796265 Vendors: n/a Products: n/a Problem Types: n/a Description: A CSV injection vulnerability in Automation Anywhere Automation 360 version 21094 allows attackers to execute arbitrary code via a crafted payload. NOTE: Automation Anywhere disputes this report, arguing the attacker executes everything from the client side and does not attack the Control Room. The payload is being injected in the http Response from the client-side, so the owner of the Response and payload is the end user in this case. They contend that the server's security controls have no impact or role to play in this s
is the end user in this case. They contend that the server's security controls have no impact or role to play in this situation and therefore this is not a valid vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.automationanywhere.com/products/automation-360 - https://medium.com/%40aksalsalimi/cve-2024-41226-response-manipulation-led-to-csv-injection-9ae3182dcc02
CVE ID: CVE-2024-41228 State: PUBLISHED Published: 2024-09-23T00:00:00 Last Updated: 2024-09-23T16:48:32.088Z Vendors: n/a Products: n/a Problem Types: n/a Description: A symlink following vulnerability in the pouch cp function of AliyunContainerService pouch v1.3.1 allows attackers to escalate privileges and write arbitrary files. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gist.github.com/cafan/68ed2d065a4b9c1c37c70a18077ad27b
CVE ID: CVE-2024-41236 State: PUBLISHED Published: 2024-08-28T00:00:00 Last Updated: 2024-08-28T18:05:05.030Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection vulnerability in /smsa/admin_login.php in Kashipara Responsive School Management System v3.2.0 allows an attacker to execute arbitrary SQL commands via the "username" parameter of the Admin Login Page Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.kashipara.com/project/php/12362/responsive-school-management-system-php-project-source-code - https://github.com/takekaramey/CVE_Writeup/blob/main/Kashipara/Responsive%20School%20Management%20System%20v3.2.0/SQL%20Injection%20-%20Admin.p
karamey/CVE_Writeup/blob/main/Kashipara/Responsive%20School%20Management%20System%20v3.2.0/SQL%20Injection%20-%20Admin.pdf