Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
t/ipv4/tcp_dctcp.c:143 tcp_in_ack_event net/ipv4/tcp_input.c:3802 [inline] tcp_ack+0x17b1/0x3bc0 net/ipv4/tcp_input.c:3948 tcp_rcv_state_process+0x57a/0x2290 net/ipv4/tcp_input.c:6711 tcp_v4_do_rcv+0x764/0xc40 net/ipv4/tcp_ipv4.c:1937 sk_backlog_rcv include/net/sock.h:1106 [inline] __release_sock+0x20f/0x350 net/core/sock.c:2983 release_sock+0x61/0x1f0 net/core/sock.c:3549 mptcp_subflow_shutdown+0x3d0/0x620 net/mptcp/protocol.c:2907 mptcp_check_send_data_fin+0x225/0x410 net/mptcp/protocol.c:2976 __mptcp_close+0x238/0xad0 net/mptcp/protocol.c:3072 mptcp_close+0x2a/0x1a0 net/mptcp/protocol.c:3127 inet_release+0x190/0x1f0 net/ipv4/af_inet.c:437 __sock_release net/socket.c:659 [inline] sock_clos
mptcp/protocol.c:3127 inet_release+0x190/0x1f0 net/ipv4/af_inet.c:437 __sock_release net/socket.c:659 [inline] sock_close+0xc0/0x240 net/socket.c:1421 __fput+0x41b/0x890 fs/file_table.c:422 task_work_run+0x23b/0x300 kernel/task_work.c:180 exit_task_work include/linux/task_work.h:38 [inline] do_exit+0x9c8/0x2540 kernel/exit.c:878 do_group_exit+0x201/0x2b0 kernel/exit.c:1027 __do_sys_exit_group kernel/exit.c:1038 [inline] __se_sys_exit_group kernel/exit.c:1036 [inline] __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1036 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xe4/0x240 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x67/0x6f RIP: 0033:0x7f6c2b5005b6 Code: Una
all_64+0xe4/0x240 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x67/0x6f RIP: 0033:0x7f6c2b5005b6 Code: Unable to access opcode bytes at 0x7f6c2b50058c. RSP: 002b:00007ffe883eb948 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 RAX: ffffffffffffffda RBX: 00007f6c2b5862f0 RCX: 00007f6c2b5005b6 RDX: 0000000000000001 RSI: 000000000000003c RDI: 0000000000000001 RBP: 0000000000000001 R08: 00000000000000e7 R09: ffffffffffffffc0 R10: 0000000000000006 R11: 0000000000000246 R12: 00007f6c2b5862f0 R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000001 </TASK> Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/06d
ional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/06d0fe049b51b0a92a70df8333fd85c4ba3eb2c6 - https://git.kernel.org/stable/c/6aacaa80d962f4916ccf90e2080306cec6c90fcf - https://git.kernel.org/stable/c/e9b2f60636d18dfd0dd4965b3316f88dfd6a2b31 - https://git.kernel.org/stable/c/8602150286a2a860a1dc55cbd04f99316f19b40a - https://git.kernel.org/stable/c/e65d13ec00a738fa7661925fd5929ab3c765d4be - https://git.kernel.org/stable/c/02261d3f9dc7d1d7be7d778f839e3404ab99034c - https://git.kernel.org/stable/c/237340dee373b97833a491d2e99fcf1d4a9adafd - https://git.kernel.org/stable/c/3ebc46ca8675de6378e3f8f40768e180bb8afa66
CVE ID: CVE-2024-37357 State: PUBLISHED Published: 2025-01-14T14:21:28.194Z Last Updated: 2025-01-14T16:03:53.745Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Wavlink Products: Wavlink AC3000 Problem Types: CWE-120 Description: A buffer overflow vulnerability exists in the adm.cgi set_TR069() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to stack-based buffer overflow. An attacker can make an authenticated HTTP request to trigger this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2024-2029
CVE ID: CVE-2024-37358 State: PUBLISHED Published: 2025-02-06T11:22:38.260Z Last Updated: 2025-09-01T09:40:18.781Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) Vendors: Apache Software Foundation Products: Apache James server Problem Types: CWE-770 Description: Similarly to CVE-2024-34055, Apache James is vulnerable to denial of service through the abuse of IMAP literals from both authenticated and unauthenticated users, which could be used to cause unbounded memory allocation and very long computations Version 3.7.6 and 3.8.2 restrict such illegitimate use of IMAP literals. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://lists.apache.org/th
imate use of IMAP literals. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/1pxsh11v5s3fkvhnqvkmlqwt3fgpcrqc
CVE ID: CVE-2024-37359 State: PUBLISHED Published: 2025-02-19T22:58:57.599Z Last Updated: 2025-02-20T20:54:18.244Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: Hitachi Vantara Products: Pentaho Data Integration & Analytics, Pentaho Business Analytics Server Problem Types: CWE-918 Description: The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. (CWE-918) Hitachi Vantara Pentaho Business Analytics Server versions before 10.2.0.0 and 9.3.0.9, including 8.3.x, do not validate the Host header of incoming
ess Analytics Server versions before 10.2.0.0 and 9.3.0.9, including 8.3.x, do not validate the Host header of incoming HTTP/HTTPS requests. By providing URLs to unexpected hosts or ports, attackers can make it appear that the server is sending the request, possibly bypassing access controls such as firewalls that prevent the attackers from accessing the URLs directly. The server can be used as a proxy to conduct port scanning of hosts in internal networks, use other URLs such as that can access documents on the system (using file://), or use other protocols such as gopher:// or tftp://, which may provide greater control over the contents of requests. Additional Analyst Notes: - CISA ADP Vul
// or tftp://, which may provide greater control over the contents of requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.pentaho.com/hc/en-us/articles/34296789835917--Resolved-Hitachi-Vantara-Pentaho-Business-Analytics-Server-Server-Side-Request-Forgery-Versions-before-10-2-0-0-and-9-3-0-9-including-8-3-x-Impacted-CVE-2024-37359
CVE ID: CVE-2024-37360 State: PUBLISHED Published: 2025-02-19T23:01:41.632Z Last Updated: 2025-02-20T17:22:08.769Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N) Vendors: Hitachi Vantara Products: Pentaho Data Integration & Analytics, Pentaho Business Analytics Server Problem Types: CWE-79 Description: Hitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') The software does not neutralize or incorrectly neutralize user-controllable input before it is placed in output that is used as a web page that is served to other users. (CWE-79) Hitachi Vantara Pentaho Business Analytics Server pri
that is used as a web page that is served to other users. (CWE-79) Hitachi Vantara Pentaho Business Analytics Server prior to versions 10.2.0.0 and 9.3.0.9, including 8.3.x, allow a malicious URL to inject content into the Analyzer plugin interface. Once the malicious script is injected, the attacker can perform a variety of malicious activities. The attacker could transfer private information, such as cookies that may include session information, from the victim's machine to the attacker. The attacker could send malicious requests to a web site on behalf of the victim, which could be especially dangerous to the site if the victim has administrator privileges to manage that site. Additional
ch could be especially dangerous to the site if the victim has administrator privileges to manage that site. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.pentaho.com/hc/en-us/articles/34298351866893--Resolved-Hitachi-Vantara-Pentaho-Business-Analytics-Server-Improper-Neutralization-of-Input-During-Web-Page-Generation-Cross-site-Scripting-CVE-2024-37360
CVE ID: CVE-2024-37361 State: PUBLISHED Published: 2025-02-19T23:25:33.256Z Last Updated: 2025-02-20T17:21:31.689Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Hitachi Vantara Products: Pentaho Data Integration & Analytics, Pentaho Business Analytics Server Problem Types: CWE-502 Description: The application deserializes untrusted data without sufficiently verifying that the resulting data will be valid. (CWE-502) Hitachi Vantara Pentaho Business Analytics Server versions before 10.2.0.0 and 9.3.0.9, including 8.3.x, deserialize untrusted JSON data without constraining the parser to approved classes and methods. When developers place no restrictions on
ted JSON data without constraining the parser to approved classes and methods. When developers place no restrictions on "gadget chains," or series of instances and method invocations that can self-execute during the deserialization process (i.e., before the object is returned to the caller), it is sometimes possible for attackers to leverage them to perform unauthorized actions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.pentaho.com/hc/en-us/articles/34299135441805--Resolved-Hitachi-Vantara-Pentaho-Business-Analytics-Server-Deserialization-of-Untrusted-Data-Versions-before-10-2-0-0-and-9-3-0-9-including-8-3-x-Impacted-CVE-2024-37361
CVE ID: CVE-2024-37362 State: PUBLISHED Published: 2025-02-19T23:34:29.558Z Last Updated: 2025-02-20T17:23:41.440Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Hitachi Vantara Products: Pentaho Data Integration & Analytics, Pentaho Business Analytics Server Problem Types: CWE-522 Description: The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval. (CWE-522) Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.0 and 9.3.0.8, including 8.3.x, discloses database passwords when saving connections to RedShift. Products must not disclose
9.3.0.8, including 8.3.x, discloses database passwords when saving connections to RedShift. Products must not disclose sensitive information without cause. Disclosure of sensitive information can lead to further exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.pentaho.com/hc/en-us/articles/34296552220941--Resolved-Hitachi-Vantara-Pentaho-Data-Integration-Analytics-Insufficiently-Protected-Credentials-Versions-before-10-2-0-0-and-9-3-0-8-including-8-3-x-Impacted-CVE-2024-37362
CVE ID: CVE-2024-37363 State: PUBLISHED Published: 2025-02-19T23:40:10.095Z Last Updated: 2025-02-20T17:23:30.526Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Hitachi Vantara Products: Pentaho Data Integration & Analytics, Pentaho Business Analytics Server Problem Types: CWE-862 Description: The product does not perform an authorization check when an actor attempts to access a resource or perform an action. (CWE-862) Hitachi Vantara Pentaho Business Analytics Server versions before 10.2.0.0 and 9.3.0.8, including 8.3.x, do not correctly perform an authorization check in the data source management service. When access control checks are incorrectly applie
perform an authorization check in the data source management service. When access control checks are incorrectly applied, users can access data or perform actions that they should not be allowed to perform. This can lead to a wide range of problems, including information exposures and denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.pentaho.com/hc/en-us/articles/34296230504589--Resolved-Hitachi-Vantara-Pentaho-Business-Analytics-Server-Incorrect-Authorization-Versions-before-10-2-0-0-and-9-3-0-8-including-8-3-x-Impacted-CVE-2024-37363
CVE ID: CVE-2024-37364 State: PUBLISHED Published: 2024-06-06T18:15:25.951Z Last Updated: 2025-02-13T15:59:49.162Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AC:L/AV:P/A:H/C:H/I:H/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: Ariane Allegro Scenario Player through 2024-03-05, when Ariane Duo kiosk mode is used, allows physically proximate attackers to obtain sensitive information (such as hotel invoice content with PII), and potentially create unauthorized room keys, by entering a guest-search quote character and then accessing the underlying Windows OS. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.pentagrid.ch/en/
. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.pentagrid.ch/en/blog/ariane-allegro-hotel-check-in-terminal-kios-escape/ - https://news.ycombinator.com/item?id=40582475
CVE ID: CVE-2024-37365 State: PUBLISHED Published: 2024-11-12T14:52:55.556Z Last Updated: 2024-11-12T19:04:00.897Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Rockwell Automation Products: FactoryTalk View Machine Edition Problem Types: CWE-20 Description: A remote code execution vulnerability exists in the affected product. The vulnerability allows users to save projects within the public directory allowing anyone with local access to modify and/or delete files. Additionally, a malicious user could potentially leverage this vulnerability to escalate their privileges by changing the macro to execute arbitrary code. Additional Analyst Notes: - CISA ADP Vuln
to escalate their privileges by changing the macro to execute arbitrary code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1709.html
CVE ID: CVE-2024-37367 State: PUBLISHED Published: 2024-06-14T14:17:54.951Z Last Updated: 2024-08-02T03:50:56.151Z Vendors: Rockwell Automation Products: FactoryTalk® View SE Problem Types: CWE-287 Description: A user authentication vulnerability exists in the Rockwell Automation FactoryTalk® View SE v12. The vulnerability allows a user from a remote system with FTView to send a packet to the customer’s server to view an HMI project. This action is allowed without proper authentication verification. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1675.html
CVE ID: CVE-2024-37368 State: PUBLISHED Published: 2024-06-14T14:30:53.422Z Last Updated: 2024-08-02T03:50:56.219Z Vendors: Rockwell Automation Products: FactoryTalk® View SE Problem Types: CWE-287 Description: A user authentication vulnerability exists in the Rockwell Automation FactoryTalk® View SE. The vulnerability allows a user from a remote system with FTView to send a packet to the customer’s server to view an HMI project. Due to the lack of proper authentication, this action is allowed without proper authentication verification. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://https://www.rockwellautomation.com/en-us/trust-center/secur
Vulnrichment: - CVE Program Container: References: - https://https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1676.html
CVE ID: CVE-2024-37369 State: PUBLISHED Published: 2024-06-14T16:50:20.187Z Last Updated: 2024-08-02T03:50:56.129Z Vendors: Rockwell Automation Products: FactoryTalk® View SE Problem Types: CWE-732 Description: A privilege escalation vulnerability exists in the affected product. The vulnerability allows low-privilege users to edit scripts, bypassing Access Control Lists, and potentially gaining further access within the system. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1674.html
CVE ID: CVE-2024-37370 State: PUBLISHED Published: 2024-06-28T00:00:00.000Z Last Updated: 2025-03-13T18:14:25.560Z Vendors: n/a Products: n/a Problem Types: n/a Description: In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can modify the plaintext Extra Count field of a confidential GSS krb5 wrap token, causing the unwrapped token to appear truncated to the application. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://web.mit.edu/kerberos/www/advisories/ - https://github.com/krb5/krb5/commit/55fbf435edbe2e92dd8101669b1ce7144bc96fef
CVE ID: CVE-2024-37371 State: PUBLISHED Published: 2024-06-28T00:00:00.000Z Last Updated: 2025-11-03T20:38:01.079Z Vendors: n/a Products: n/a Problem Types: n/a Description: In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can cause invalid memory reads during GSS message token handling by sending message tokens with invalid length fields. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://web.mit.edu/kerberos/www/advisories/ - https://github.com/krb5/krb5/commit/55fbf435edbe2e92dd8101669b1ce7144bc96fef
CVE ID: CVE-2024-37372 State: PUBLISHED Published: 2025-01-09T00:33:47.662Z Last Updated: 2025-05-02T23:03:00.375Z Severity: LOW (CVSS 3.6 CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: NodeJS Products: Node Description: The Permission Model assumes that any path starting with two backslashes \ has a four-character prefix that can be ignored, which is not always true. This subtle bug leads to vulnerable edge cases. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2024/07/11/6 - http://www.openwall.com/lists/oss-security/2024/07/19/3
CVE ID: CVE-2024-37373 State: PUBLISHED Published: 2024-08-14T02:38:00.225Z Last Updated: 2024-08-16T04:01:47.192Z Severity: HIGH (CVSS 7.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Ivanti Products: Avalanche Description: Improper input validation in the Central Filestore in Ivanti Avalanche 6.3.1 allows a remote authenticated attacker with admin rights to achieve RCE. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Avalanche-6-4-4-CVE-2024-38652-CVE-2024-38653-CVE-2024-36136-CVE-2024-37399-CVE-2024-37373
CVE ID: CVE-2024-37374 State: REJECTED Published: 2025-02-15T00:25:31.746Z Last Updated: 2025-02-15T00:31:39.728Z Description: No description available.
CVE ID: CVE-2024-37375 State: REJECTED Published: 2025-02-15T00:25:31.747Z Last Updated: 2025-02-15T00:31:40.019Z Description: No description available.
CVE ID: CVE-2024-37376 State: PUBLISHED Published: 2024-11-13T01:54:45.383Z Last Updated: 2024-11-19T04:55:56.052Z Severity: HIGH (CVSS 7.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Ivanti Products: EPM Description: SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-EPM-November-2024-for-EPM-2024-and-EPM-2022
CVE ID: CVE-2024-37377 State: PUBLISHED Published: 2024-12-11T18:52:27.462Z Last Updated: 2024-12-12T14:46:24.352Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Ivanti Products: Connect Secure Description: A heap-based buffer overflow in IPsec of Ivanti Connect Secure before version 22.7R2.3 allows a remote unauthenticated attacker to cause a denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/December-2024-Security-Advisory-Ivanti-Connect-Secure-ICS-and-Ivanti-Policy-Secure-IPS-Multiple-CVEs
CVE ID: CVE-2024-37380 State: PUBLISHED Published: 2024-07-22T18:38:00.606Z Last Updated: 2024-11-05T21:45:45.233Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Ubiquiti Products: UniFi U6+ Access Point Description: A misconfiguration on UniFi U6+ Access Point could cause an incorrect VLAN traffic forwarding to APs meshed to UniFi U6+ Access Point. Affected Products: UniFi U6+ Access Point (Version 6.6.65 and earlier) Mitigation: Update your UniFi U6+ Access Point to Version 6.6.74 or later. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://community.ui.com/releases/Security-Advisory-Bulletin-041-041/df92860f
nt: - CVE Program Container: References: - https://community.ui.com/releases/Security-Advisory-Bulletin-041-041/df92860f-0379-4002-be47-6819a25a73a1
CVE ID: CVE-2024-37381 State: PUBLISHED Published: 2024-07-29T05:43:16.144Z Last Updated: 2024-08-02T03:50:55.937Z Severity: HIGH (CVSS 8.4 CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Ivanti Products: EPM Description: An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2024 flat allows an authenticated attacker within the same network to execute arbitrary code. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://forums.ivanti.com/s/article/Security-Advisory-EPM-July-2024-for-EPM-2024
CVE ID: CVE-2024-37382 State: PUBLISHED Published: 2024-08-08T00:00:00 Last Updated: 2024-08-08T19:32:43.294Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue discovered in import host feature in Ab Initio Metadata Hub and Authorization Gateway before 4.3.1.1 allows attackers to run arbitrary code via crafted modification of server configuration. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.abinitio.com/en/security-advisories/ab-2024-003/
CVE ID: CVE-2024-37383 State: PUBLISHED Published: 2024-06-07T00:00:00.000Z Last Updated: 2025-10-21T23:05:16.615Z Vendors: n/a Products: n/a Problem Types: n/a Description: Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via SVG animate attributes. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/roundcube/roundcubemail/commit/43aaaa528646877789ec028d87924ba1accf5242 - https://github.com/roundcube/roundcubemail/releases/tag/1.6.7 - https://github.com/roundcube/roundcubemail/releases/tag/1.5.7 - https://lists.debian.org/debian-lts-announce/2024/06/msg00008.html
CVE ID: CVE-2024-37384 State: PUBLISHED Published: 2024-06-07T00:00:00 Last Updated: 2024-11-04T16:24:03.779Z Vendors: n/a Products: n/a Problem Types: n/a Description: Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via list columns from user preferences. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/roundcube/roundcubemail/releases/tag/1.6.7 - https://github.com/roundcube/roundcubemail/releases/tag/1.5.7 - https://github.com/roundcube/roundcubemail/commit/cde4522c5c95f13c6aeeb1600ab17e5067a536f7 - https://lists.debian.org/debian-lts-announce/2024/06/msg00008.html
CVE ID: CVE-2024-37385 State: PUBLISHED Published: 2024-06-07T03:24:23.567Z Last Updated: 2025-02-13T15:59:49.701Z Vendors: n/a Products: n/a Problem Types: n/a Description: Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 on Windows allows command injection via im_convert_path and im_identify_path. NOTE: this issue exists because of an incomplete fix for CVE-2020-12641. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/roundcube/roundcubemail/releases/tag/1.6.7 - https://github.com/roundcube/roundcubemail/releases/tag/1.5.7 - https://github.com/roundcube/roundcubemail/commit/5ea9f37ce39374b6124586c0590fec7015d35d7f
CVE ID: CVE-2024-37386 State: PUBLISHED Published: 2024-07-15T00:00:00 Last Updated: 2024-08-02T03:50:56.059Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Stormshield Network Security (SNS) 4.0.0 through 4.3.25, 4.4.0 through 4.7.5, and 4.8.0. Certain manipulations allow restarting in single-user mode despite the activation of secure boot. The following versions fix this: 4.3.27, 4.7.6, and 4.8.2. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://advisories.stormshield.eu/2024-017