Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-3483 State: PUBLISHED Published: 2024-05-15T16:44:00.950Z Last Updated: 2024-08-01T20:12:07.210Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: OpenText Products: iManager Problem Types: CWE-502, CWE-434, CWE-77 Description: Remote Code Execution has been discovered in OpenText™ iManager 3.2.6.0200. The vulnerability can trigger command injection and insecure deserialization issues. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.netiq.com/documentation/imanager-32/imanager326_patch3_hf1_releasenotes/data/imanager326_patch3_hf1_releasenotes.html
CVE ID: CVE-2024-3484 State: PUBLISHED Published: 2024-05-15T16:44:51.636Z Last Updated: 2024-08-01T20:12:07.760Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) Vendors: OpenText Products: iManager Problem Types: CWE-22 Description: Path Traversal found in OpenText™ iManager 3.2.6.0200. This can lead to privilege escalation or file disclosure. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.netiq.com/documentation/imanager-32/imanager326_patch3_hf1_releasenotes/data/imanager326_patch3_hf1_releasenotes.html
CVE ID: CVE-2024-3485 State: PUBLISHED Published: 2024-05-15T16:45:25.287Z Last Updated: 2024-08-01T20:12:07.715Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N) Vendors: OpenText Products: iManager Problem Types: CWE-918 Description: Server Side Request Forgery vulnerability has been discovered in OpenText™ iManager 3.2.6.0200. This could lead to senstive information disclosure. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.netiq.com/documentation/imanager-32/imanager326_patch3_hf1_releasenotes/data/imanager326_patch3_hf1_releasenotes.html
CVE ID: CVE-2024-3486 State: PUBLISHED Published: 2024-05-15T16:46:03.081Z Last Updated: 2024-08-01T20:12:07.653Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: OpenText Products: iManager Problem Types: CWE-611 Description: XML External Entity injection vulnerability found in OpenText™ iManager 3.2.6.0200. This could lead to information disclosure and remote code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.netiq.com/documentation/imanager-32/imanager326_patch3_hf1_releasenotes/data/imanager326_patch3_hf1_releasenotes.html
CVE ID: CVE-2024-3487 State: PUBLISHED Published: 2024-05-15T16:47:07.862Z Last Updated: 2024-08-01T20:12:07.629Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: OpenText Products: iManager Problem Types: CWE-287 Description: Broken Authentication vulnerability discovered in OpenText™ iManager 3.2.6.0200. This vulnerability allows an attacker to manipulate certain parameters to bypass authentication. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.netiq.com/documentation/imanager-32/imanager326_patch3_hf1_releasenotes/data/imanager326_patch3_hf1_releasenotes.html
CVE ID: CVE-2024-3488 State: PUBLISHED Published: 2024-05-15T16:47:41.613Z Last Updated: 2024-08-01T20:12:07.634Z Severity: MEDIUM (CVSS 5.6 CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:C/C:N/I:N/A:H) Vendors: OpenText Products: iManager Problem Types: CWE-20 Description: File Upload vulnerability in unauthenticated session found in OpenText™ iManager 3.2.6.0200. The vulnerability could allow ant attacker to upload a file without authentication. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.netiq.com/documentation/imanager-32/imanager326_patch3_hf1_releasenotes/data/imanager326_patch3_hf1_releasenotes.html
CVE ID: CVE-2024-3489 State: PUBLISHED Published: 2024-05-02T16:52:14.525Z Last Updated: 2024-08-01T20:12:07.637Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: timstrifler Products: Exclusive Addons for Elementor Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the Countdown Expired Title in all versions up to, and including, 2.6.9.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in p
itization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/76b987f1-2524-498a-a02c-a3ca390026e1?source=cve - https://plugins.trac.wordpress.org/changeset/3074085/exclusive-addons-for-elementor/trunk/elements/countdown-timer/countdown-timer.php
CVE ID: CVE-2024-3490 State: PUBLISHED Published: 2024-05-02T06:51:32.797Z Last Updated: 2024-08-01T20:12:07.272Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: brechtvds Products: WP Recipe Maker Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wprm-recipe-roundup-item shortcode in all versions up to, and including, 9.3.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level acc
put escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/69cc7b6c-b6c2-4bba-afb4-86ba1b36b295?source=cve - https://plugins.trac.wordpress.org/changeset/3078644/wp-recipe-maker
CVE ID: CVE-2024-3491 State: PUBLISHED Published: 2024-04-23T11:07:23.883Z Last Updated: 2024-08-01T20:12:07.656Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: magazine3 Products: Schema & Structured Data for WP & AMP Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's "How To" and "FAQ" Blocks in all versions up to, and including, 1.29 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated att
ficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e004bba3-d281-4f84-a941-a6c5b64b9dcd?source=cve - https://plugins.trac.wordpress.org/changeset/3071620/schema-and-structured-data-for-wp
CVE ID: CVE-2024-3492 State: PUBLISHED Published: 2024-06-12T11:05:08.700Z Last Updated: 2024-08-01T20:12:07.271Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: netweblogic Products: Events Manager – Calendar, Bookings, Tickets, and more! Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'event', 'location', and 'event_category' shortcodes in all versions up to, and including, 6.4.7.3 due to insufficient input sanitization and output escaping on us
hortcodes in all versions up to, and including, 6.4.7.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a767f65e-bc7d-4576-af78-b77bd23dc089?source=cve - https://plugins.trac.wordpress.org/changeset/3101326/events-manager
CVE ID: CVE-2024-3493 State: PUBLISHED Published: 2024-04-15T21:17:36.077Z Last Updated: 2024-08-12T15:16:08.155Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) Vendors: Rockwell Automation Products: ControlLogix 5580, GuardLogix 5580, CompactLogix 5380, 1756-EN4TR Problem Types: CWE-20 Description: A specific malformed fragmented packet type (fragmented packets may be generated automatically by devices that send large amounts of data) can cause a major nonrecoverable fault (MNRF) Rockwell Automation's ControlLogix 5580, Guard Logix 5580, CompactLogix 5380, and 1756-EN4TR. If exploited, the affected product will become unavailable and require a manual restart to recov
x 5380, and 1756-EN4TR. If exploited, the affected product will become unavailable and require a manual restart to recover it. Additionally, an MNRF could result in a loss of view and/or control of connected devices. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.rockwellautomation.com/en-us/support/advisory.SD1666.html
CVE ID: CVE-2024-3494 State: PUBLISHED Published: 2024-05-08T05:31:06.878Z Last Updated: 2024-08-01T20:12:07.601Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: horearadu Products: Mesmerize Companion Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Mesmerize Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mesmerize_contact_form' shortcode in all versions up to, and including, 1.6.148 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor
on and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/521bb5a3-0a0c-4693-a87d-fabb64f1ad4f?source=cve - https://plugins.trac.wordpress.org/changeset/3078422/mesmerize-companion/trunk/theme-data/mesmerize/functions.php
CVE ID: CVE-2024-3495 State: PUBLISHED Published: 2024-05-22T08:31:21.432Z Last Updated: 2024-08-01T20:12:07.689Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: trustyplugins Products: Country State City Dropdown CF7 Problem Types: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Description: The Country State City Dropdown CF7 plugin for WordPress is vulnerable to SQL Injection via the ‘cnt’ and 'sid' parameters in versions up to, and including, 2.7.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticate
pplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/17dcacaf-0e2a-4bef-b944-fb7e43d25777?source=cve - https://plugins.trac.wordpress.org/browser/country-state-city-auto-dropdown/trunk/includes/ajax-actions.php#L8 - https://plugins.trac.wordpress.org/browser/country-state-city-auto-dropdown/trunk/includes/ajax-actions.php#L22 - https://plu
://plugins.trac.wordpress.org/browser/country-state-city-auto-dropdown/trunk/includes/ajax-actions.php#L22 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3089374%40country-state-city-auto-dropdown%2Ftrunk&old=3068802%40country-state-city-auto-dropdown%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2024-3496 State: PUBLISHED Published: 2024-06-14T04:13:22.003Z Last Updated: 2024-08-19T12:45:16.203Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Toshiba Tec Corporation Products: Toshiba Tec e-Studio multi-function peripheral (MFP) Problem Types: CWE-288 Description: Attackers can bypass the web login authentication process to gain access to the printer's system information and upload malicious drivers to the printer. As for the affected products/models/versions, see the reference URL. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.toshibatec.com/information/20240531_01.html - https://www.
Container: - CISA ADP Vulnrichment: References: - https://www.toshibatec.com/information/20240531_01.html - https://www.toshibatec.com/information/pdf/information20240531_01.pdf - https://jvn.jp/en/vu/JVNVU97136265/index.html
CVE ID: CVE-2024-3497 State: PUBLISHED Published: 2024-06-14T04:17:56.164Z Last Updated: 2024-08-01T20:12:07.639Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Toshiba Tec Corporation Products: Toshiba Tec e-Studio multi-function peripheral (MFP) Problem Types: CWE-23 Description: Path traversal vulnerability in the web server of the Toshiba printer enables attacker to overwrite orginal files or add new ones to the printer. As for the affected products/models/versions, see the reference URL. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.toshibatec.com/information/20240531_01.html - https://www.toshibate
: - CVE Program Container: References: - https://www.toshibatec.com/information/20240531_01.html - https://www.toshibatec.com/information/pdf/information20240531_01.pdf - https://jvn.jp/en/vu/JVNVU97136265/index.html
CVE ID: CVE-2024-3498 State: PUBLISHED Published: 2024-06-14T04:20:01.103Z Last Updated: 2024-08-01T20:12:07.649Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Toshiba Tec Corporation Products: Toshiba Tec e-Studio multi-function peripheral (MFP) Problem Types: CWE-250 Description: Attackers can then execute malicious files by enabling certain services of the printer via the web configuration page and elevate its privileges to root. As for the affected products/models/versions, see the reference URL. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.toshibatec.com/information/20240531_01.html - https://www.
nrichment: - CVE Program Container: References: - https://www.toshibatec.com/information/20240531_01.html - https://www.toshibatec.com/information/pdf/information20240531_01.pdf - https://jvn.jp/en/vu/JVNVU97136265/index.html
CVE ID: CVE-2024-3499 State: PUBLISHED Published: 2024-05-02T16:52:09.867Z Last Updated: 2024-08-01T20:12:07.692Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: xpeedstudio Products: ElementsKit Elementor addons and Templates Library Problem Types: CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') Description: The ElementsKit Elementor addons plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.1.0 via the generate_navigation_markup function of the Onepage Scroll module. This makes it possible for authenticated attackers, with contributor-level access an
ction of the Onepage Scroll module. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6158ec37-a6fb-42f9-bab6-bf547ea28ea0?source=cve - https://plugins.trac.wordpress.org/changeset/3070789/elementskit-lite
CVE ID: CVE-2024-3500 State: PUBLISHED Published: 2024-05-02T16:52:38.096Z Last Updated: 2024-08-01T20:12:07.674Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: wpmet Products: ElementsKit Pro Problem Types: CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') Description: The ElementsKit Pro plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.6.0 via the Price Menu, Hotspot, and Advanced Toggle widgets. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary files on the server, allowin
icated attackers, with contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c8ae0a47-cba5-468e-8d25-7b7176373b9c?source=cve - https://account.wpmet.com/downloads/elementskit/?changelog=1
CVE ID: CVE-2024-3501 State: PUBLISHED Published: 2024-11-14T17:34:36.048Z Last Updated: 2025-01-30T13:09:20.820Z Severity: CRITICAL (CVSS 9.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: lunary-ai Products: lunary-ai/lunary Problem Types: CWE-922 Description: In lunary-ai/lunary versions up to and including 1.2.5, an information disclosure vulnerability exists due to the inclusion of single-use tokens in the responses of `GET /v1/users/me` and `GET /v1/users/me/org` API endpoints. These tokens, intended for sensitive operations such as password resets or account verification, are exposed to unauthorized actors, potentially allowing them to perform actions on behalf of the user. Th
verification, are exposed to unauthorized actors, potentially allowing them to perform actions on behalf of the user. This issue was addressed in version 1.2.6, where the exposure of single-use tokens in user-facing queries was mitigated. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/8fdfdb9d-10bd-4f00-8004-d5baabc20c6e - https://github.com/lunary-ai/lunary/commit/17e95f6c99c7d5ac4ee5451c5857b97a12892c74
CVE ID: CVE-2024-3502 State: PUBLISHED Published: 2024-11-14T17:34:45.226Z Last Updated: 2025-10-15T12:50:23.304Z Severity: CRITICAL (CVSS 9.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: lunary-ai Products: lunary-ai/lunary Problem Types: CWE-201 Description: In lunary-ai/lunary versions up to and including 1.2.5, an information disclosure vulnerability exists where account recovery hashes of users are inadvertently exposed to unauthorized actors. This issue occurs when authenticated users inspect responses from `GET /v1/users/me` and `GET /v1/users/me/org` endpoints. The exposed account recovery hashes, while not directly related to user passwords, represent sensitive information
ints. The exposed account recovery hashes, while not directly related to user passwords, represent sensitive information that should not be accessible to unauthorized parties. Exposing these hashes could potentially facilitate account recovery attacks or other malicious activities. The vulnerability was addressed in version 1.2.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/c2aff952-2dec-4538-8905-190c484aae94 - https://github.com/lunary-ai/lunary/commit/17e95f6c99c7d5ac4ee5451c5857b97a12892c74
CVE ID: CVE-2024-3504 State: PUBLISHED Published: 2024-06-06T17:53:40.589Z Last Updated: 2025-10-15T12:49:37.495Z Severity: HIGH (CVSS 8.1 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) Vendors: lunary-ai Products: lunary-ai/lunary Problem Types: CWE-863 Description: An improper access control vulnerability exists in lunary-ai/lunary versions up to and including 1.2.2, where an admin can update any organization user to the organization owner. This vulnerability allows the elevated user to delete projects within the organization. The issue is resolved in version 1.2.7. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/97958fe4-
onal Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/97958fe4-be21-4b63-966f-8337c72c8e28 - https://github.com/lunary-ai/lunary/commit/f7507f0949f6634f725ebb8da37c44f76542901f
CVE ID: CVE-2024-3505 State: PUBLISHED Published: 2024-04-15T07:42:27.975Z Last Updated: 2024-08-01T20:12:07.415Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: JFrog Products: Artifactory Self-Hosted Problem Types: CWE-200 Description: JFrog Artifactory Self-Hosted versions below 7.77.3, are vulnerable to sensitive information disclosure whereby a low-privileged authenticated user can read the proxy configuration. This does not affect JFrog cloud deployments. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://jfrog.com/help/r/jfrog-release-information/jfrog-security-advisories
CVE ID: CVE-2024-3506 State: PUBLISHED Published: 2024-10-08T10:00:38.099Z Last Updated: 2024-10-08T13:50:58.073Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L) Vendors: Milestone Systems Products: XProtect VMS Problem Types: CWE-120 Description: A possible buffer overflow in selected cameras' drivers from XProtect Device Pack can allow an attacker with access to internal network to execute commands on Recording Server under strict conditions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://supportcommunity.milestonesys.com/KBRedir?art=000065801&lang=en_US
CVE ID: CVE-2024-3507 State: PUBLISHED Published: 2024-05-08T10:46:23.861Z Last Updated: 2024-08-01T20:12:07.605Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N) Vendors: Lunar Products: Lunar Problem Types: CWE-269 Description: Improper privilege management vulnerability in Lunar software that affects versions 6.0.2 through 6.6.0. This vulnerability allows an attacker to perform a secondary process injection into the Lunar application and abuse those rights to access sensitive user information. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/privilege-escalation-vulnerability-
Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/privilege-escalation-vulnerability-lunar