Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
9 (MR4), 9.00 prior to 9.00.2374 (MR5), 8.90 prior to 8.90.2356 (MR6), all versions of 8.80 and prior. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2024-42407
CVE ID: CVE-2024-42408 State: PUBLISHED Published: 2024-08-08T17:27:17.383Z Last Updated: 2024-08-09T15:02:38.084Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Dorsett Controls Products: InfoScan Problem Types: CWE-22 Description: The InfoScan client download page can be intercepted with a proxy, to expose filenames located on the system, which could lead to additional information exposure. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-221-01 - https://portal.dtscada.com/#/security-bulletins?bulletin=1
CVE ID: CVE-2024-42410 State: PUBLISHED Published: 2025-02-12T21:18:50.452Z Last Updated: 2025-02-13T15:20:09.351Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H) Vendors: n/a Products: Intel(R) Graphics Drivers Problem Types: Denial of Service, CWE-20 Description: Improper input validation in some Intel(R) Graphics Drivers may allow an authenticated user to potentially enable denial of service via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01235.html
CVE ID: CVE-2024-42411 State: PUBLISHED Published: 2024-08-22T06:32:57.137Z Last Updated: 2024-08-22T13:22:35.586Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: Mattermost Products: Mattermost Problem Types: CWE-754 Description: Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0, 9.8.x <= 9.8.2 fail to restrict the input in POST /api/v4/users which allows a user to manipulate the creation date in POST /api/v4/users tricking the admin into believing their account is much older. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2024-42412 State: PUBLISHED Published: 2024-08-30T06:29:27.606Z Last Updated: 2025-09-19T17:23:20.358Z Severity: MEDIUM (CVSS 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: ELECOM CO.,LTD. Products: WAB-I1750-PS, WAB-M1775-PS, WAB-S1167-PS, WAB-S1775, WAB-S733MI Problem Types: CWE-79 Description: Cross-site scripting vulnerability exists in ELECOM wireless access points due to improper processing of input values in menu.cgi. If a user views a malicious web page while logged in to the product, an arbitrary script may be executed on the user's web browser. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.elecom.co.jp/news/security/20240827-01
ser. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.elecom.co.jp/news/security/20240827-01/ - https://jvn.jp/en/jp/JVN24885537/
CVE ID: CVE-2024-42415 State: PUBLISHED Published: 2024-10-03T15:24:57.874Z Last Updated: 2025-11-03T22:04:50.389Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: GNOME Project Products: G Structured File Library (libgsf) Problem Types: CWE-190 Description: An integer overflow vulnerability exists in the Compound Document Binary File format parser of v1.14.52 of the GNOME Project G Structured File Library (libgsf). A specially crafted file can result in an integer overflow that allows for a heap-based buffer overflow when processing the sector allocation table. This can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this
r allocation table. This can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2024-2069 - https://gitlab.gnome.org/GNOME/libgsf/-/issues/34
CVE ID: CVE-2024-42416 State: PUBLISHED Published: 2024-09-05T04:31:15.698Z Last Updated: 2025-11-04T16:13:44.630Z Vendors: FreeBSD Products: FreeBSD Problem Types: CWE-790, CWE-823 Description: The ctl_report_supported_opcodes function did not sufficiently validate a field provided by userspace, allowing an arbitrary write to a limited amount of kernel help memory. Malicious software running in a guest VM that exposes virtio_scsi can exploit the vulnerabilities to achieve code execution on the host in the bhyve userspace process, which typically runs as root. Note that bhyve runs in a Capsicum sandbox, so malicious code is constrained by the capabilities available to the bhyve process. A ma
ve runs in a Capsicum sandbox, so malicious code is constrained by the capabilities available to the bhyve process. A malicious iSCSI initiator could achieve remote code execution on the iSCSI target host. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://security.freebsd.org/advisories/FreeBSD-SA-24:11.ctl.asc
CVE ID: CVE-2024-42417 State: PUBLISHED Published: 2024-10-03T22:32:59.999Z Last Updated: 2024-10-04T14:14:32.287Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Delta Electronics Products: DIAEnergie Problem Types: CWE-89 Description: Delta Electronics DIAEnergie is vulnerable to an SQL injection in the script Handler_CFG.ashx. An authenticated attacker may be able to exploit this issue to cause delay in the targeted product. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-277-03 - https://www.deltaww.com/en-US/Cybersecurity_Advisory
CVE ID: CVE-2024-42418 State: PUBLISHED Published: 2024-08-22T19:52:32.736Z Last Updated: 2024-08-22T20:14:28.840Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Avtec Products: Outpost 0810, Outpost Uploader Utility Problem Types: CWE-321 Description: Avtec Outpost uses a default cryptographic key that can be used to decrypt sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-235-04
CVE ID: CVE-2024-42419 State: PUBLISHED Published: 2025-02-12T21:18:52.201Z Last Updated: 2025-02-13T15:19:23.207Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) GPA and Intel(R) GPA Framework software installers Problem Types: Escalation of Privilege, CWE-276 Description: Incorrect default permissions for some Intel(R) GPA and Intel(R) GPA Framework software installers may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01233.html
CVE ID: CVE-2024-42420 State: PUBLISHED Published: 2024-10-25T06:18:00.481Z Last Updated: 2024-10-25T18:37:13.542Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Sharp Corporation, Toshiba Tec Corporation Products: Sharp Digital Full-color MFPs and Monochrome MFPs, e-STUDIO 908, e-STUDIO 1058, e-STUDIO 1208 Problem Types: CWE-125 Description: Sharp and Toshiba Tec MFPs contain multiple Out-of-bounds Read vulnerabilities, due to improper processing of keyword search input and improper processing of SOAP messages. Crafted HTTP requests may cause affected products crashed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://jvn.jp/en/vu/JVNV
se affected products crashed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://jvn.jp/en/vu/JVNVU95063136/ - https://global.sharp/products/copier/info/info_security_2024-10.html - https://www.toshibatec.com/information/20241025_01.html
CVE ID: CVE-2024-42422 State: PUBLISHED Published: 2024-12-03T12:15:28.497Z Last Updated: 2024-12-03T14:23:59.792Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L) Vendors: Dell Products: NetWorker Problem Types: CWE-639 Description: Dell NetWorker, version(s) 19.10, contain(s) an Authorization Bypass Through User-Controlled Key vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000255892/dsa-2024-478-security-update-for-dell-networker-vulnerabilities
CVE ID: CVE-2024-42423 State: PUBLISHED Published: 2024-09-10T14:55:58.906Z Last Updated: 2024-09-10T19:09:13.543Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) Vendors: Dell Products: Wyse Proprietary OS (Modern ThinOS) Problem Types: CWE-863 Description: Citrix Workspace App version 23.9.0.24.4 on Dell ThinOS 2311 contains an Incorrect Authorization vulnerability when Citrix CEB is enabled for WebLogin. A local unauthenticated user with low privileges may potentially exploit this vulnerability to bypass existing controls and perform unauthorized actions leading to information disclosure and tampering. Additional Analyst Notes: - CISA ADP Vulnrichment: References:
actions leading to information disclosure and tampering. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000225289/dsa-2024-229-security-update-for-dell-thinos-vulnerabilities
CVE ID: CVE-2024-42424 State: PUBLISHED Published: 2024-09-10T08:05:43.080Z Last Updated: 2024-09-10T15:11:45.356Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N) Vendors: Dell Products: Dell Precision Rack BIOS Problem Types: CWE-20 Description: Dell Precision Rack, 14G Intel BIOS versions prior to 2.22.2, contains an Improper Input Validation vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Information disclosure. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000227014/dsa-2024-327
CVE ID: CVE-2024-42425 State: PUBLISHED Published: 2024-09-10T08:17:04.690Z Last Updated: 2024-09-10T15:08:54.037Z Severity: LOW (CVSS 3.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) Vendors: Dell Products: Dell Precision Rack BIOS Problem Types: CWE-788 Description: Dell Precision Rack, 14G Intel BIOS versions prior to 2.22.2, contains an Access of Memory Location After End of Buffer vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information disclosure. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000227015/dsa-2024-328
CVE ID: CVE-2024-42426 State: PUBLISHED Published: 2024-12-09T14:38:33.650Z Last Updated: 2024-12-09T15:05:07.664Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: Dell Products: PowerScale OneFS Problem Types: CWE-400 Description: Dell PowerScale OneFS Versions 9.5.0.x through 9.8.0.x contain an uncontrolled resource consumption vulnerability. A low privilege remote attacker could potentially exploit this vulnerability, leading to denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-in/000256645/dsa-2024-453-security-update-for-dell-powerscale-onefs-multiple-security-vulnerabilities
CVE ID: CVE-2024-42427 State: PUBLISHED Published: 2024-09-10T07:39:17.775Z Last Updated: 2024-09-10T15:16:23.482Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Dell Products: Wyse Proprietary OS (Modern ThinOS) Problem Types: CWE-77 Description: Dell ThinOS versions 2402 and 2405, contains an Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability. An unauthenticated attacker with physical access could potentially exploit this vulnerability, leading to Elevation of privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000228350/dsa-2024-386
CVE ID: CVE-2024-42434 State: PUBLISHED Published: 2024-08-14T16:39:38.167Z Last Updated: 2025-10-07T13:15:09.341Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: Zoom Communications Inc. Products: Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers Problem Types: CWE-862 Description: Missing authorization in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow a privileged user to conduct an information disclosure via network access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zoom.com/en/trust/security-bulletin/zsb-24030
CVE ID: CVE-2024-42435 State: PUBLISHED Published: 2024-08-14T16:39:46.183Z Last Updated: 2024-08-15T13:58:02.205Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: Zoom Communications Inc. Products: Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers Problem Types: CWE-200 Description: Sensitive information disclosure in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow a privileged user to conduct an information disclosure via network access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zoom.com/en/trust/security-bulletin/zsb-24030
CVE ID: CVE-2024-42436 State: PUBLISHED Published: 2024-08-14T16:41:03.844Z Last Updated: 2024-08-14T18:25:52.686Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Zoom Communications Inc. Products: Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers Problem Types: CWE-122 Description: Buffer overflow in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow an authenticated user to conduct a denial of service via network access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zoom.com/en/trust/security-bulletin/zsb-24031
CVE ID: CVE-2024-42437 State: PUBLISHED Published: 2024-08-14T16:41:12.866Z Last Updated: 2024-08-14T17:44:29.139Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Zoom Communications Inc. Products: Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers Problem Types: CWE-122 Description: Buffer overflow in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow an authenticated user to conduct a denial of service via network access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zoom.com/en/trust/security-bulletin/zsb-24031
CVE ID: CVE-2024-42438 State: PUBLISHED Published: 2024-08-14T16:41:18.732Z Last Updated: 2024-08-16T20:05:07.811Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Zoom Communications Inc. Products: Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers Problem Types: CWE-122 Description: Buffer overflow in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow an authenticated user to conduct a denial of service via network access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zoom.com/en/trust/security-bulletin/zsb-24031
CVE ID: CVE-2024-42439 State: PUBLISHED Published: 2024-08-14T16:42:48.215Z Last Updated: 2024-08-16T13:18:48.409Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H) Vendors: Zoom Communications Inc. Products: Zoom Workplace Desktop App for macOS and Zoom Meeting SDK for macOS Problem Types: CWE-426 Description: Untrusted search path in the installer for Zoom Workplace Desktop App for macOS and Zoom Meeting SDK for macOS before 6.1.0 may allow a privileged user to conduct an escalation of privilege via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zoom.com/en/trust/security-bulletin/zsb-24032
CVE ID: CVE-2024-42440 State: PUBLISHED Published: 2024-08-14T16:44:46.080Z Last Updated: 2024-08-14T18:06:25.844Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:P/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Zoom Communications Inc. Products: Zoom Workplace Desktop App for macOS, Zoom Meeting SDK for macOS, Zoom Rooms Client for macOS Problem Types: CWE-269 Description: Improper privilege management in the installer for Zoom Workplace Desktop App for macOS, Zoom Meeting SDK for macOS and Zoom Rooms Client for macOS before 6.1.5 may allow a privileged user to conduct an escalation of privilege via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zoom.com/en/trus
rivilege via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zoom.com/en/trust/security-bulletin/zsb-24034
CVE ID: CVE-2024-42441 State: PUBLISHED Published: 2024-08-14T16:46:17.936Z Last Updated: 2025-10-07T13:17:05.280Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:P/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Zoom Communications Inc. Products: Zoom Workplace Desktop App for macOS, Zoom Meeting SDK for macOS, Zoom Rooms Client for macOS Problem Types: CWE-266 Description: Incorrect privilege assignment in the installer for Zoom Workplace Desktop App for macOS, Zoom Meeting SDK for macOS and Zoom Rooms Client for macOS before 6.1.5 may allow a privileged user to conduct an escalation of privilege via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zoom.com/en/tru
privilege via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zoom.com/en/trust/security-bulletin/zsb-24034
CVE ID: CVE-2024-42442 State: PUBLISHED Published: 2024-11-12T15:00:34.738Z Last Updated: 2024-11-12T15:58:50.679Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: AMI Products: AptioV Problem Types: CWE-119 Description: APTIOV contains a vulnerability in the BIOS where a user or attacker may cause an improper restriction of operations within the bounds of a memory buffer over the network. A successful exploitation of this vulnerability may lead to code execution outside of the intended System Management Mode. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://9443417.fs1.hubspotusercontent-na1.net/hubfs/9443417/Security%20Advisories/2024/
ADP Vulnrichment: References: - https://9443417.fs1.hubspotusercontent-na1.net/hubfs/9443417/Security%20Advisories/2024/AMI-SA-2024004.pdf
CVE ID: CVE-2024-42444 State: PUBLISHED Published: 2025-01-14T15:00:42.112Z Last Updated: 2025-01-14T15:45:23.217Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: AMI Products: AptioV Problem Types: CWE-367 Description: APTIOV contains a vulnerability in BIOS where an attacker may cause a TOCTOU Race Condition by local means. Successful exploitation of this vulnerability may lead to execution of arbitrary code on the target device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://go.ami.com/hubfs/Security%20Advisories/2025/AMI-SA-2025001.pdf
CVE ID: CVE-2024-42446 State: PUBLISHED Published: 2025-05-13T14:02:10.628Z Last Updated: 2025-05-13T15:16:25.056Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: AMI Products: AptioV Problem Types: CWE-367 Description: APTIOV contains a vulnerability in BIOS where an attacker may cause a Time-of-check Time-of-use (TOCTOU) Race Condition by local means. Successful exploitation of this vulnerability may lead to arbitrary code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://go.ami.com/hubfs/Security%20Advisories/2025/AMI-SA-2025004.pdf
CVE ID: CVE-2024-42447 State: PUBLISHED Published: 2024-08-05T08:02:31.921Z Last Updated: 2025-03-19T14:39:15.524Z Vendors: Apache Software Foundation Products: Apache Airflow Providers FAB Problem Types: CWE-613 Description: Insufficient Session Expiration vulnerability in Apache Airflow Providers FAB. This issue affects Apache Airflow Providers FAB: 1.2.1 (when used with Apache Airflow 2.9.3) and FAB 1.2.0 for all Airflow versions. The FAB provider prevented the user from logging out. * FAB provider 1.2.1 only affected Airflow 2.9.3 (earlier and later versions of Airflow are not affected) * FAB provider 1.2.0 affected all versions of Airflow. Users who run Apache Airflow 2.9.3 are recommen
are not affected) * FAB provider 1.2.0 affected all versions of Airflow. Users who run Apache Airflow 2.9.3 are recommended to upgrade to Apache Airflow Providers FAB version 1.2.2 which fixes the issue. Users who run Any Apache Airflow version and have FAB provider 1.2.0 are recommended to upgrade to Apache Airflow Providers FAB version 1.2.2 which fixes the issue. Also upgrading Apache Airflow to latest version available is recommended. Note: Early version of Airflow reference container images of Airflow 2.9.3 and constraint files contained FAB provider 1.2.1 version, but this is fixed in updated versions of the images. Users are advised to pull the latest Airflow images or reinstall FAB p
this is fixed in updated versions of the images. Users are advised to pull the latest Airflow images or reinstall FAB provider according to the current constraints. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/apache/airflow/pull/40784 - https://lists.apache.org/thread/2zoo8cjlwfjhbfdxfgltcm0hnc0qmc52
CVE ID: CVE-2024-42448 State: PUBLISHED Published: 2024-12-11T18:52:27.501Z Last Updated: 2024-12-12T14:42:44.457Z Severity: CRITICAL (CVSS 9.9 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Veeam Products: Service Provider Console Description: From the VSPC management agent machine, under condition that the management agent is authorized on the server, it is possible to perform Remote Code Execution (RCE) on the VSPC server machine. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.veeam.com/kb4679
CVE ID: CVE-2024-42449 State: PUBLISHED Published: 2024-12-04T01:06:04.625Z Last Updated: 2025-03-13T14:54:19.282Z Severity: HIGH (CVSS 7.1 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H) Vendors: Veeam Products: Service Provider Console Description: From the VSPC management agent machine, under condition that the management agent is authorized on the server, it is possible to remove arbitrary files on the VSPC server machine. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.veeam.com/kb4679
CVE ID: CVE-2024-42450 State: PUBLISHED Published: 2024-11-19T17:21:41.498Z Last Updated: 2024-11-21T04:55:12.404Z Severity: CRITICAL (CVSS 10 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Versa Products: Director Description: The Versa Director uses PostgreSQL (Postgres) to store operational and configuration data. It is also needed for High Availability function of the Versa Director. The default configuration has a common password across all instances of Versa Director. By default, Versa Director configures Postgres to listen on all network interfaces. This combination allows an unauthenticated attacker to access and administer the database or read local filesystem contents to es
ination allows an unauthenticated attacker to access and administer the database or read local filesystem contents to escalate privileges on the system. Exploitation Status: Versa Networks is not aware of this exploitation in any production systems. A proof of concept exists in the lab environment. Workarounds or Mitigation: Starting with the latest 22.1.4 version of Versa Director, the software will automatically restrict access to the Postgres and HA ports to only the local and peer Versa Directors. For older releases, Versa recommends performing manual hardening of HA ports. Please refer to the following link for the steps https://docs.versa-networks.com/Solutions/System_Hardening/Perform