Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-25592 State: PUBLISHED Published: 2024-03-15T13:56:02.689Z Last Updated: 2024-08-01T23:44:09.633Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: WPMU DEV Products: Broken Link Checker Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPMU DEV Broken Link Checker allows Stored XSS.This issue affects Broken Link Checker: from n/a through 2.2.3. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/broken-link-checker/wordpress-broken-link-checker-plugin-2-2-3-cross-site-script
//patchstack.com/database/vulnerability/broken-link-checker/wordpress-broken-link-checker-plugin-2-2-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-25593 State: PUBLISHED Published: 2024-03-15T13:57:45.891Z Last Updated: 2024-08-01T23:44:09.625Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Basix Products: NEX-Forms – Ultimate Form Builder Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Basix NEX-Forms – Ultimate Form Builder allows Stored XSS.This issue affects NEX-Forms – Ultimate Form Builder: from n/a through 8.5.5. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/nex-forms-express-wp-form-builder/wordpress-
gram Container: References: - https://patchstack.com/database/vulnerability/nex-forms-express-wp-form-builder/wordpress-nex-forms-plugin-8-5-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-25594 State: PUBLISHED Published: 2024-02-29T06:17:16.317Z Last Updated: 2024-08-01T23:44:09.671Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Savvy Wordpress Development Products: MyWaze Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Savvy Wordpress Development MyWaze allows Stored XSS.This issue affects MyWaze: from n/a through 1.6. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/my-waze/wordpress-mywaze-plugin-1-6-cross-site-scripting-xss-vulnerability?_s_id=cv
atchstack.com/database/vulnerability/my-waze/wordpress-mywaze-plugin-1-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-25595 State: PUBLISHED Published: 2024-05-17T08:23:10.160Z Last Updated: 2024-08-01T23:44:09.759Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: WPMU DEV Products: Defender Security Problem Types: CWE-290 Description: Authentication Bypass by Spoofing vulnerability in WPMU DEV Defender Security allows Functionality Bypass.This issue affects Defender Security: from n/a through 4.4.1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/defender-security/wordpress-defender-security-plugin-4-4-1-ip-restriction-bypass-vulnerability?_s_id=cve
CVE ID: CVE-2024-25596 State: PUBLISHED Published: 2024-03-15T13:59:27.467Z Last Updated: 2024-08-01T23:44:09.654Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Doofinder Products: Doofinder for WooCommerce Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Doofinder Doofinder for WooCommerce allows Stored XSS.This issue affects Doofinder for WooCommerce: from n/a through 2.1.8. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/doofinder-for-woocommerce/wordpress-doofinder-for-woocommerc
References: - https://patchstack.com/database/vulnerability/doofinder-for-woocommerce/wordpress-doofinder-for-woocommerce-plugin-2-1-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-25597 State: PUBLISHED Published: 2024-03-15T14:01:44.989Z Last Updated: 2024-08-01T23:44:09.625Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Etoile Web Design Products: Ultimate Reviews Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Etoile Web Design Ultimate Reviews allows Stored XSS.This issue affects Ultimate Reviews: from n/a through 3.2.8. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/ultimate-reviews/wordpress-ultimate-reviews-plugin-3-2-8-unauthenticated-
https://patchstack.com/database/vulnerability/ultimate-reviews/wordpress-ultimate-reviews-plugin-3-2-8-unauthenticated-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-25598 State: PUBLISHED Published: 2024-03-15T13:07:37.793Z Last Updated: 2024-08-01T23:44:09.675Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Livemesh Products: Livemesh Addons for Elementor Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Livemesh Livemesh Addons for Elementor allows Stored XSS.This issue affects Livemesh Addons for Elementor: from n/a through 8.3. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/addons-for-elementor/wordpress-elementor-addons-by-l
tainer: References: - https://patchstack.com/database/vulnerability/addons-for-elementor/wordpress-elementor-addons-by-livemesh-plugin-8-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-25599 State: PUBLISHED Published: 2024-03-28T06:52:19.640Z Last Updated: 2025-03-25T14:44:10.003Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Castos Products: Seriously Simple Podcasting Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Castos Seriously Simple Podcasting allows Reflected XSS.This issue affects Seriously Simple Podcasting: from n/a through 3.0.2. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/seriously-simple-podcasting/wordpress-seriously-simple-podc
References: - https://patchstack.com/database/vulnerability/seriously-simple-podcasting/wordpress-seriously-simple-podcasting-plugin-3-0-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-25600 State: PUBLISHED Published: 2024-06-04T12:51:27.971Z Last Updated: 2025-07-03T13:36:17.468Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Codeer Limited Products: Bricks Builder Problem Types: CWE-94 Description: Improper Control of Generation of Code ('Code Injection') vulnerability in Codeer Limited Bricks Builder allows Code Injection.This issue affects Bricks Builder: from n/a through 1.9.6. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/bricks/wordpress-bricks-theme-1-9-6-unauthenticated-remote-code-execution-rce-vulnerability?_s_id=cve - h
/vulnerability/bricks/wordpress-bricks-theme-1-9-6-unauthenticated-remote-code-execution-rce-vulnerability?_s_id=cve - https://snicco.io/vulnerability-disclosure/bricks/unauthenticated-rce-in-bricks-1-9-6 - https://patchstack.com/articles/critical-rce-patched-in-bricks-builder-theme?_s_id=cve - https://github.com/K3ysTr0K3R/CVE-2024-25600-EXPLOIT - https://github.com/Chocapikk/CVE-2024-25600
CVE ID: CVE-2024-25601 State: PUBLISHED Published: 2024-02-21T01:54:47.283Z Last Updated: 2024-08-01T23:44:09.660Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: Liferay Products: Portal, DXP Problem Types: CWE-79 Description: Stored cross-site scripting (XSS) vulnerability in Expando module's geolocation custom fields in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 17, and older unsupported versions allows remote authenticated users to inject arbitrary web script or HTML via a crafted payload injected into the name text field of a geolocation custom field. Additional Anal
eb script or HTML via a crafted payload injected into the name text field of a geolocation custom field. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25601
CVE ID: CVE-2024-25602 State: PUBLISHED Published: 2024-02-21T01:45:15.312Z Last Updated: 2024-08-01T23:44:09.672Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: Liferay Products: Portal, DXP Problem Types: CWE-79 Description: Stored cross-site scripting (XSS) vulnerability in Users Admin module's edit user page in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 17, and older unsupported versions allows remote authenticated users to inject arbitrary web script or HTML via a crafted payload injected into an organization’s “Name” text field Additional Analyst Notes: - CISA ADP
pt or HTML via a crafted payload injected into an organization’s “Name” text field Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25602
CVE ID: CVE-2024-25603 State: PUBLISHED Published: 2024-02-21T02:09:59.923Z Last Updated: 2024-08-20T19:57:19.139Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: Liferay Products: Portal, DXP Problem Types: CWE-79 Description: Stored cross-site scripting (XSS) vulnerability in the Dynamic Data Mapping module's DDMForm in Liferay Portal 7.2.0 through 7.4.3.4, and older unsupported versions, and Liferay DXP 7.4.13, 7.3 before update 4, 7.2 before fix pack 17, and older unsupported versions allows remote authenticated users to inject arbitrary web script or HTML via the instanceId parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnric
y web script or HTML via the instanceId parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25603
CVE ID: CVE-2024-25604 State: PUBLISHED Published: 2024-02-20T08:40:59.252Z Last Updated: 2024-08-01T23:44:09.655Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: Liferay Products: Portal, DXP Problem Types: CWE-863 Description: Liferay Portal 7.2.0 through 7.4.3.4, and older unsupported versions, and Liferay DXP 7.4.13, 7.3 before service pack 3, 7.2 before fix pack 17, and older unsupported versions does not properly check user permissions, which allows remote authenticated users with the VIEW user permission to edit their own permission via the User and Organizations section of the Control Panel. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Pr
via the User and Organizations section of the Control Panel. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25604
CVE ID: CVE-2024-25605 State: PUBLISHED Published: 2024-02-20T08:51:32.953Z Last Updated: 2025-04-24T15:05:21.654Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Liferay Products: Portal, DXP Problem Types: CWE-276 Description: The Journal module in Liferay Portal 7.2.0 through 7.4.3.4, and older unsupported versions, and Liferay DXP 7.4.13, 7.3 before service pack 3, 7.2 before fix pack 17, and older unsupported versions grants guest users view permission to web content templates by default, which allows remote attackers to view any template via the UI or API. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https:/
ate via the UI or API. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25605
CVE ID: CVE-2024-25606 State: PUBLISHED Published: 2024-02-20T09:03:19.221Z Last Updated: 2024-08-01T23:44:09.795Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Liferay Products: Portal, DXP Problem Types: CWE-611 Description: XXE vulnerability in Liferay Portal 7.2.0 through 7.4.3.7, and older unsupported versions, and Liferay DXP 7.4 before update 4, 7.3 before update 12, 7.2 before fix pack 20, and older unsupported versions allows attackers with permission to deploy widgets/portlets/extensions to obtain sensitive information or consume system resources via the Java2WsddTask._format method. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Co
stem resources via the Java2WsddTask._format method. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25606
CVE ID: CVE-2024-25607 State: PUBLISHED Published: 2024-02-20T09:17:04.894Z Last Updated: 2024-08-01T23:44:09.762Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: Liferay Products: Portal, DXP Problem Types: CWE-916 Description: The default password hashing algorithm (PBKDF2-HMAC-SHA1) in Liferay Portal 7.2.0 through 7.4.3.15, and older unsupported versions, and Liferay DXP 7.4 before update 16, 7.3 before update 4, 7.2 before fix pack 17, and older unsupported versions defaults to a low work factor, which allows attackers to quickly crack password hashes. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://liferay
ssword hashes. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25607
CVE ID: CVE-2024-25608 State: PUBLISHED Published: 2024-02-20T09:26:10.743Z Last Updated: 2024-08-01T23:44:09.704Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Liferay Products: Portal, DXP Problem Types: CWE-601 Description: HtmlUtil.escapeRedirect in Liferay Portal 7.2.0 through 7.4.3.18, and older unsupported versions, and Liferay DXP 7.4 before update 19, 7.3 before update 4, 7.2 before fix pack 19, and older unsupported versions can be circumvented by using the 'REPLACEMENT CHARACTER' (U+FFFD), which allows remote attackers to redirect users to arbitrary external URLs via the (1) 'redirect` parameter (2) `FORWARD_URL` parameter, (3) `noSuchEntryRedir
ect users to arbitrary external URLs via the (1) 'redirect` parameter (2) `FORWARD_URL` parameter, (3) `noSuchEntryRedirect` parameter, and (4) others parameters that rely on HtmlUtil.escapeRedirect. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25608
CVE ID: CVE-2024-25609 State: PUBLISHED Published: 2024-02-20T09:37:55.362Z Last Updated: 2024-08-23T19:19:20.308Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Liferay Products: Portal, DXP Problem Types: CWE-601 Description: HtmlUtil.escapeRedirect in Liferay Portal 7.2.0 through 7.4.3.12, and older unsupported versions, and Liferay DXP 7.4 before update 9, 7.3 service pack 3, 7.2 fix pack 15 through 18, and older unsupported versions can be circumvented by using two forward slashes, which allows remote attackers to redirect users to arbitrary external URLs via the (1) 'redirect` parameter (2) `FORWARD_URL` parameter, and (3) others parameters that rely
bitrary external URLs via the (1) 'redirect` parameter (2) `FORWARD_URL` parameter, and (3) others parameters that rely on HtmlUtil.escapeRedirect. This vulnerability is the result of an incomplete fix in CVE-2022-28977. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25609
CVE ID: CVE-2024-25610 State: PUBLISHED Published: 2024-02-20T12:42:46.027Z Last Updated: 2024-08-28T13:37:03.603Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: Liferay Products: Portal, DXP Problem Types: CWE-1188 Description: In Liferay Portal 7.2.0 through 7.4.3.12, and older unsupported versions, and Liferay DXP 7.4 before update 9, 7.3 before update 4, 7.2 before fix pack 19, and older unsupported versions, the default configuration does not sanitize blog entries of JavaScript, which allows remote authenticated users to inject arbitrary web script or HTML (XSS) via a crafted payload injected into a blog entry’s content text field. Additional Analyst N
ary web script or HTML (XSS) via a crafted payload injected into a blog entry’s content text field. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25610
CVE ID: CVE-2024-25611 State: PUBLISHED Published: 2024-03-05T20:16:02.870Z Last Updated: 2024-08-01T23:44:09.733Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Hewlett Packard Enterprise (HPE) Products: ArubaOS Wi-Fi Controllers and Campus/Remote Access Points Description: Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.arubanetworks.com/assets/alert/ARUBA-P
otes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-002.txt
CVE ID: CVE-2024-25612 State: PUBLISHED Published: 2024-03-05T20:16:59.563Z Last Updated: 2024-08-01T23:44:09.672Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Hewlett Packard Enterprise (HPE) Products: ArubaOS Wi-Fi Controllers and Campus/Remote Access Points Description: Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.arubanetworks.com/assets/alert/ARUBA-P
CVE ID: CVE-2024-25613 State: PUBLISHED Published: 2024-03-05T20:17:55.396Z Last Updated: 2024-08-01T23:44:09.825Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Hewlett Packard Enterprise (HPE) Products: ArubaOS Wi-Fi Controllers and Campus/Remote Access Points Description: Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.arubanetworks.com/assets/alert/ARUBA-P
CVE ID: CVE-2024-25614 State: PUBLISHED Published: 2024-03-05T20:19:09.850Z Last Updated: 2024-10-29T20:21:27.256Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H) Vendors: Hewlett Packard Enterprise (HPE) Products: ArubaOS Wi-Fi Controllers and Campus/Remote Access Points Description: There is an arbitrary file deletion vulnerability in the CLI used by ArubaOS. Successful exploitation of this vulnerability results in the ability to delete arbitrary files on the underlying operating system, which could lead to denial-of-service conditions and impact the integrity of the controller. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References:
the integrity of the controller. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-002.txt
CVE ID: CVE-2024-25615 State: PUBLISHED Published: 2024-03-05T20:19:54.342Z Last Updated: 2025-03-27T20:13:45.183Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Hewlett Packard Enterprise (HPE) Products: ArubaOS Wi-Fi Controllers and Campus/Remote Access Points Description: An unauthenticated Denial-of-Service (DoS) vulnerability exists in the Spectrum service accessed via the PAPI protocol in ArubaOS 8.x. Successful exploitation of this vulnerability results in the ability to interrupt the normal operation of the affected service. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.arubanetworks.com/assets
onal Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-002.txt
CVE ID: CVE-2024-25616 State: PUBLISHED Published: 2024-03-05T20:20:35.905Z Last Updated: 2024-11-07T17:05:17.507Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Hewlett Packard Enterprise (HPE) Products: ArubaOS Wi-Fi Controllers and Campus/Remote Access Points Description: Aruba has identified certain configurations of ArubaOS that can lead to partial disclosure of sensitive information in the IKE_AUTH negotiation process. The scenarios in which disclosure of potentially sensitive information can occur are complex, and depend on factors beyond the control of attackers. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: -
ond the control of attackers. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-002.txt
CVE ID: CVE-2024-25617 State: PUBLISHED Published: 2024-02-14T20:55:52.004Z Last Updated: 2025-02-13T17:40:50.579Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: squid-cache Products: squid Problem Types: CWE-400, CWE-182 Description: Squid is an open source caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a Collapse of Data into Unsafe Value bug ,Squid may be vulnerable to a Denial of Service attack against HTTP header parsing. This problem allows a remote client or a remote server to perform Denial of Service when sending oversized headers in HTTP messages. In versions of Squid prior to 6.5 this can be achieved if the request_header
sending oversized headers in HTTP messages. In versions of Squid prior to 6.5 this can be achieved if the request_header_max_size or reply_header_max_size settings are unchanged from the default. In Squid version 6.5 and later, the default setting of these parameters is safe. Squid will emit a critical warning in cache.log if the administrator is setting these parameters to unsafe values. Squid will not at this time prevent these settings from being changed to unsafe values. Users are advised to upgrade to version 6.5. There are no known workarounds for this vulnerability. This issue is also tracked as SQUID-2024:2 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: R
This issue is also tracked as SQUID-2024:2 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/squid-cache/squid/security/advisories/GHSA-h5x6-w8mv-xfpr - https://github.com/squid-cache/squid/commit/72a3bbd5e431597c3fdb56d752bc56b010ba3817 - https://security.netapp.com/advisory/ntap-20240322-0006/