Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-49415 State: PUBLISHED Published: 2024-12-03T05:47:58.657Z Last Updated: 2024-12-03T11:28:15.756Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Samsung Mobile Products: Samsung Mobile Devices Problem Types: CWE-122: Heap-based Buffer Overflow Description: Out-of-bound write in libsaped.so prior to SMR Dec-2024 Release 1 allows remote attackers to execute arbitrary code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=12
CVE ID: CVE-2024-49416 State: PUBLISHED Published: 2024-12-03T05:47:59.990Z Last Updated: 2024-12-03T11:43:45.274Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Samsung Mobile Products: SmartThings Problem Types: CWE-927: Use of Implicit Intent for Sensitive Communication Description: Use of implicit intent for sensitive communication in SmartThings prior to version 1.8.21 allows local attackers to get sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.samsungmobile.com/serviceWeb.smsb?year=2024&month=12
CVE ID: CVE-2024-49417 State: PUBLISHED Published: 2024-12-03T05:48:01.520Z Last Updated: 2024-12-03T11:43:45.039Z Severity: LOW (CVSS 2 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N) Vendors: Samsung Mobile Products: Smart Touch Call Problem Types: CWE-927 : Use of Implicit Intent for Sensitive Communication Description: Use of implicit intent for sensitive communication in Smart Touch Call prior to 1.0.0.8 allows local attackers to launch privileged activities. User interaction is required for triggering this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.samsungmobile.com/serviceWeb.smsb?year=2024&month=12
CVE ID: CVE-2024-49418 State: PUBLISHED Published: 2024-12-03T05:48:02.786Z Last Updated: 2024-12-03T11:43:44.884Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) Vendors: Samsung Mobile Products: GamingHub Problem Types: CWE-20: Improper Input Validation Description: Insufficient verification of url authenticity in GamingHub prior to version 6.1.03.4 in Korea, 7.1.02.4 in Global allows remote attackers to enable JavaScript in its webview. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.samsungmobile.com/serviceWeb.smsb?year=2024&month=12
CVE ID: CVE-2024-49419 State: PUBLISHED Published: 2024-12-03T05:48:04.036Z Last Updated: 2024-12-03T11:43:44.738Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Samsung Mobile Products: GamingHub Problem Types: CWE-20: Improper Input Validation Description: Insufficient verification of url authenticity in GamingHub prior to version 6.1.03.4 in Korea, 7.1.02.4 in Global allows remote attackers to load an arbitrary URL in its webview. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.samsungmobile.com/serviceWeb.smsb?year=2024&month=12
CVE ID: CVE-2024-49420 State: PUBLISHED Published: 2024-12-03T05:48:05.296Z Last Updated: 2024-12-03T14:29:58.864Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Samsung Mobile Products: GamingHub Problem Types: CWE-1287: Improper Validation of Specified Type of Input Description: Improper handling of responses in GamingHub prior to version 6.1.04.6 in Korea, 7.1.03.7 in Global allows remote attackers to launch arbitrary activity. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.samsungmobile.com/serviceWeb.smsb?year=2024&month=12
CVE ID: CVE-2024-49421 State: PUBLISHED Published: 2024-12-03T05:48:06.555Z Last Updated: 2024-12-03T14:25:22.984Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: Samsung Mobile Products: Quick Share Agent Problem Types: CWE-22: Improper Limitation of a Pathname to a Restricted Directory (&#39;Path Traversal&#39;) Description: Path traversal in Quick Share Agent prior to version 3.5.14.47 in Android 12, 3.5.19.41 in Android 13, and 3.5.19.42 in Android 14 allows adjacent attackers to write file in arbitrary location. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.samsungmobile.com/serviceWeb.smsb?year=2024&month=12
CVE ID: CVE-2024-49422 State: PUBLISHED Published: 2024-12-31T08:39:54.090Z Last Updated: 2024-12-31T15:50:51.554Z Severity: MEDIUM (CVSS 5.2 CVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L) Vendors: Samsung Mobile Products: Samsung Mobile Devices Problem Types: CWE-693: Protection Mechanism Failure Description: Protection Mechanism Failure in bootloader prior to SMR Oct-2024 Release 1 allows physical attackers to reset lockscreen failure count by hardware fault injection. User interaction is required for triggering this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=10
CVE ID: CVE-2024-49501 State: PUBLISHED Published: 2024-11-01T04:07:39.666Z Last Updated: 2024-11-01T15:06:52.374Z Severity: MEDIUM (CVSS 5.7 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: OMRON Corporation Products: SYSMAC-SE2[][][] Problem Types: CWE-863 Description: Sysmac Studio provided by OMRON Corporation contains an incorrect authorization vulnerability. If this vulnerability is exploited, an attacker may access the program which is protected by Data Protection function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.fa.omron.co.jp/product/security/assets/pdf/en/OMSR-2024-006_en.pdf - https://www.fa.omron.co.jp/product/security/assets/pdf/ja/OMSR
.jp/product/security/assets/pdf/en/OMSR-2024-006_en.pdf - https://www.fa.omron.co.jp/product/security/assets/pdf/ja/OMSR-2024-006_ja.pdf - https://jvn.jp/en/vu/JVNVU95685374
CVE ID: CVE-2024-49502 State: PUBLISHED Published: 2024-11-28T09:26:38.995Z Last Updated: 2024-11-28T12:25:17.023Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N) Vendors: SUSE Products: Container suse/manager/5.0/x86_64/server:5.0.2.7.8.1, SUSE Manager Server Module 4.3 Problem Types: CWE-79 Description: A Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in the Setup Wizard, HTTP Proxy credentials pane in spacewalk-web allows attackers to attack users by providing specially crafted URLs to click. This issue affects Container suse/manager/5.0/x86_64/server:5.0.2.7.8.1: before 5.0.15-150600.3.10.2; SUSE Manager Ser
. This issue affects Container suse/manager/5.0/x86_64/server:5.0.2.7.8.1: before 5.0.15-150600.3.10.2; SUSE Manager Server Module 4.3: before 4.3.42-150400.3.52.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.suse.com/show_bug.cgi?id=CVE-2024-49502
CVE ID: CVE-2024-49503 State: PUBLISHED Published: 2024-11-28T09:20:03.366Z Last Updated: 2024-11-28T12:15:16.804Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N) Vendors: SUSE Products: Container suse/manager/5.0/x86_64/server:5.0.2.7.8.1, SUSE Manager Server Module 4.3 Problem Types: CWE-79 Description: A Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in SUSE manager allows attackers to execute Javascript code in the organization credentials sub page. This issue affects Container suse/manager/5.0/x86_64/server:5.0.2.7.8.1: before 5.0.15-150600.3.10.2; SUSE Manager Server Module 4.3: before 4.3.42-150400.3.52.1
/5.0/x86_64/server:5.0.2.7.8.1: before 5.0.15-150600.3.10.2; SUSE Manager Server Module 4.3: before 4.3.42-150400.3.52.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.suse.com/show_bug.cgi?id=CVE-2024-49503
CVE ID: CVE-2024-49504 State: PUBLISHED Published: 2024-11-13T14:44:23.659Z Last Updated: 2024-11-13T18:32:06.515Z Vendors: SUSE Products: openSUSE Tumbleweed Description: grub2 allowed attackers with access to the grub shell to access files on the encrypted disks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.suse.com/show_bug.cgi?id=CVE-2024-49504
CVE ID: CVE-2024-49505 State: PUBLISHED Published: 2024-11-13T14:21:00.317Z Last Updated: 2024-11-13T18:38:11.311Z Vendors: openSUSE Products: Tumbleweed Problem Types: CWE-79 Description: A Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in openSUSE Tumbleweed MirrorCache allows the execution of arbitrary JS via reflected XSS in the REGEX and P parameters. This issue affects MirrorCache before 1.083. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.suse.com/show_bug.cgi?id=CVE-2024-49505
CVE ID: CVE-2024-49506 State: PUBLISHED Published: 2024-11-13T14:15:09.354Z Last Updated: 2024-11-21T16:14:24.983Z Vendors: openSUSE Products: Tumbleweed Problem Types: CWE-377 Description: Insecure creation of temporary files allows local users on systems with non-default configurations to cause denial of service or set the encryption key for a filesystem Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.suse.com/show_bug.cgi?id=CVE-2024-49506
CVE ID: CVE-2024-49507 State: PUBLISHED Published: 2024-11-12T20:45:22.448Z Last Updated: 2024-11-13T16:36:05.722Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: InDesign Desktop Problem Types: CWE-122 Description: InDesign Desktop versions ID18.5.2, ID19.5 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/indesign/apsb24-88.html
CVE ID: CVE-2024-49508 State: PUBLISHED Published: 2024-11-12T20:45:20.950Z Last Updated: 2024-11-13T16:35:41.179Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: InDesign Desktop Problem Types: CWE-122 Description: InDesign Desktop versions ID18.5.2, ID19.5 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/indesign/apsb24-88.html
CVE ID: CVE-2024-49509 State: PUBLISHED Published: 2024-11-12T20:45:24.441Z Last Updated: 2024-11-13T14:39:00.387Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: InDesign Desktop Problem Types: CWE-122 Description: InDesign Desktop versions ID18.5.3, ID19.5 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/indesign/apsb24-88.html
CVE ID: CVE-2024-49510 State: PUBLISHED Published: 2024-11-12T20:45:26.631Z Last Updated: 2024-11-13T14:38:59.852Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: Adobe Products: InDesign Desktop Problem Types: CWE-125 Description: InDesign Desktop versions ID18.5.3, ID19.5 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/securit
open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/indesign/apsb24-88.html
CVE ID: CVE-2024-49511 State: PUBLISHED Published: 2024-11-12T20:45:23.225Z Last Updated: 2024-11-13T14:39:00.520Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: Adobe Products: InDesign Desktop Problem Types: CWE-125 Description: InDesign Desktop versions ID18.5.3, ID19.5 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/securit
CVE ID: CVE-2024-49512 State: PUBLISHED Published: 2024-11-12T20:45:25.230Z Last Updated: 2024-11-13T14:38:59.994Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: Adobe Products: InDesign Desktop Problem Types: CWE-125 Description: InDesign Desktop versions ID18.5.3, ID19.5 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/securit
CVE ID: CVE-2024-49513 State: PUBLISHED Published: 2024-12-10T20:57:57.480Z Last Updated: 2024-12-16T16:36:38.059Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Not a product Problem Types: CWE-787 Description: PDFL SDK versions 21.0.0.5 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/pdfl-sdk1/apsb24-98.html
CVE ID: CVE-2024-49514 State: PUBLISHED Published: 2024-11-12T16:59:43.186Z Last Updated: 2024-11-12T17:23:37.453Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Photoshop Desktop Problem Types: CWE-191 Description: Photoshop Desktop versions 24.7.3, 25.11 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/photoshop/apsb24-89.htm
Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/photoshop/apsb24-89.html
CVE ID: CVE-2024-49515 State: PUBLISHED Published: 2024-11-12T20:02:29.410Z Last Updated: 2024-12-04T04:55:33.018Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Substance3D - Painter Problem Types: CWE-426 Description: Substance3D - Painter versions 10.1.0 and earlier are affected by an Untrusted Search Path vulnerability that might allow attackers to execute arbitrary code. If the application uses a search path to locate critical resources such as programs, then an attacker could modify that search path to point to a malicious program, which the targeted application would then execute. The problem extends to any type of critical resource tha
ous program, which the targeted application would then execute. The problem extends to any type of critical resource that the application trusts. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/substance3d_painter/apsb24-86.html
CVE ID: CVE-2024-49516 State: PUBLISHED Published: 2024-11-12T20:02:13.244Z Last Updated: 2024-12-04T04:55:34.214Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Substance3D - Painter Problem Types: CWE-787 Description: Substance3D - Painter versions 10.1.0 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/substance3d_painter/apsb24-86.html
CVE ID: CVE-2024-49517 State: PUBLISHED Published: 2024-11-12T20:02:19.121Z Last Updated: 2024-11-12T20:25:30.549Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Substance3D - Painter Problem Types: CWE-122 Description: Substance3D - Painter versions 10.1.0 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/substance3d_painter/apsb24-86.html
CVE ID: CVE-2024-49518 State: PUBLISHED Published: 2024-11-12T20:02:27.859Z Last Updated: 2024-11-12T20:25:29.233Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Substance3D - Painter Problem Types: CWE-787 Description: Substance3D - Painter versions 10.1.0 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/substance3d_painter/apsb24-86.html
CVE ID: CVE-2024-49519 State: PUBLISHED Published: 2024-11-12T20:02:20.708Z Last Updated: 2024-11-16T04:55:38.856Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Substance3D - Painter Problem Types: CWE-787 Description: Substance3D - Painter versions 10.1.0 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/substance3d_painter/apsb24-86.html
CVE ID: CVE-2024-49520 State: PUBLISHED Published: 2024-11-12T20:02:27.072Z Last Updated: 2024-11-12T20:25:29.372Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Substance3D - Painter Problem Types: CWE-787 Description: Substance3D - Painter versions 10.1.0 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/substance3d_painter/apsb24-86.html
CVE ID: CVE-2024-49521 State: PUBLISHED Published: 2024-11-12T16:41:28.324Z Last Updated: 2024-11-12T17:07:29.400Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: Adobe Products: Adobe Commerce Problem Types: CWE-918 Description: Adobe Commerce versions 3.2.5 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to a security feature bypass. A low privileged attacker could exploit this vulnerability to send crafted requests from the vulnerable server to internal systems, which could result in the bypassing of security measures such as firewalls. Exploitation of this issue does not require user interaction. Additional An
sing of security measures such as firewalls. Exploitation of this issue does not require user interaction. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/magento/apsb24-90.html
CVE ID: CVE-2024-49522 State: PUBLISHED Published: 2024-11-05T16:59:00.189Z Last Updated: 2024-11-05T19:03:06.976Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Substance3D - Painter Problem Types: CWE-787 Description: Substance3D - Painter versions 10.0.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/substance3d_painter/apsb24-52.html
CVE ID: CVE-2024-49523 State: PUBLISHED Published: 2024-11-07T21:35:59.953Z Last Updated: 2024-11-08T14:06:28.797Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Adobe Products: Adobe Experience Manager Problem Types: CWE-79 Description: Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/secur
CVE ID: CVE-2024-49524 State: PUBLISHED Published: 2024-11-07T21:35:59.179Z Last Updated: 2024-11-08T14:06:48.136Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Adobe Products: Adobe Experience Manager Problem Types: CWE-79 Description: Adobe Experience Manager versions 6.5.20 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by an attacker to execute arbitrary code in the context of the victim's browser session. By manipulating a DOM element through a crafted URL or user input, the attacker can inject malicious scripts that run when the page is rendered. This type of attack requires user interaction,
ttacker can inject malicious scripts that run when the page is rendered. This type of attack requires user interaction, as the victim would need to access a manipulated URL or provide specific input to trigger the vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/experience-manager/apsb24-28.html
CVE ID: CVE-2024-49525 State: PUBLISHED Published: 2024-11-12T20:02:32.388Z Last Updated: 2024-11-16T04:55:37.656Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Substance3D - Painter Problem Types: CWE-122 Description: Substance3D - Painter versions 10.1.0 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/substance3d_painter/apsb24-86.html
CVE ID: CVE-2024-49526 State: PUBLISHED Published: 2024-11-12T16:14:21.517Z Last Updated: 2024-11-12T18:46:00.336Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Animate Problem Types: CWE-416 Description: Animate versions 23.0.7, 24.0.4 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/animate/apsb24-76.html