Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-9446 State: PUBLISHED Published: 2024-10-31T06:48:55.611Z Last Updated: 2024-10-31T13:00:58.917Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: kilukrumedia Products: WP Simple Anchors Links Problem Types: CWE-79 Description: The WP Simple Anchors Links plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpanchor shortcode in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever
attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d851ad1f-be74-49eb-9c0d-c1b309581209?source=cve - https://plugins.trac.wordpress.org/browser/wp-simple-anchors-links/trunk/wpsimpleanchorslinks_class.php#L221 - https://wordpress.org/plugins/wp-simple-anchors-links/
CVE ID: CVE-2024-9447 State: PUBLISHED Published: 2025-03-20T10:10:10.551Z Last Updated: 2025-03-20T18:30:29.278Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: transformeroptimus Products: transformeroptimus/superagi Problem Types: CWE-1230 Description: An information disclosure vulnerability exists in the latest version of transformeroptimus/superagi. The `/get/organisation/` endpoint does not verify the user's organization, allowing any authenticated user to retrieve sensitive configuration details, including API keys, of any organization. This could lead to unauthorized access to services and significant data breaches or financial loss. Additional Analy
on. This could lead to unauthorized access to services and significant data breaches or financial loss. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/c952ea32-3047-42d3-8a3e-e67899e35dfd
CVE ID: CVE-2024-9448 State: PUBLISHED Published: 2025-05-08T19:14:00.226Z Last Updated: 2025-08-25T19:52:14.674Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: Arista Networks Products: EOS Problem Types: CWE-1284 Description: On affected platforms running Arista EOS with Traffic Policies configured the vulnerability will cause received untagged packets not to hit Traffic Policy rules that they are expected to hit. If the rule was to drop the packet, the packet will not be dropped and instead will be forwarded as if the rule was not in place. This could lead to packets being delivered to unexpected destinations. Additional Analyst Notes: - CISA ADP Vulnrichm
e. This could lead to packets being delivered to unexpected destinations. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://https://www.arista.com/en/support/advisories-notices/security-advisory/21121-security-advisory-0112
CVE ID: CVE-2024-9449 State: PUBLISHED Published: 2024-10-09T06:44:38.096Z Last Updated: 2024-10-09T13:28:01.693Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: gregross Products: Auto iFrame Problem Types: CWE-79 Description: The Auto iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tag' parameter in all versions up to, and including, 1.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vul
b scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1a09dcc4-37ee-425d-b824-a593c22d711f?source=cve - https://plugins.trac.wordpress.org/browser/auto-iframe/trunk/auto-iframe.php#L127 - https://wordpress.org/plugins/auto-iframe/#developers - https://plugins.trac.wordpress.org/browser/auto-iframe/trunk/auto-iframe.php#L173 - https://plugins.trac.wordpress.org/changeset/3164574/
CVE ID: CVE-2024-9450 State: PUBLISHED Published: 2025-05-15T20:07:20.940Z Last Updated: 2025-05-16T20:38:20.685Z Vendors: Unknown Products: Free Booking Plugin for Hotels, Restaurants and Car Rentals Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Free Booking Plugin for Hotels, Restaurants and Car Rentals WordPress plugin before 1.3.15 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in subscriber change them via a CSRF attack Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/f4b9568a-af74-40df-89c1-550e8515ca0a/
CVE ID: CVE-2024-9451 State: PUBLISHED Published: 2024-10-09T07:33:35.937Z Last Updated: 2024-10-09T12:47:09.229Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: afragen Products: Embed PDF Viewer Problem Types: CWE-79 Description: The Embed PDF Viewer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'height' and 'width' parameters in all versions up to, and including, 2.4.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Addition
nd above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b616e275-855d-461e-8fcb-c96098e41dfd?source=cve - https://plugins.trac.wordpress.org/browser/embed-pdf-viewer/trunk/embed-pdf-viewer.php#L258 - https://plugins.trac.wordpress.org/browser/embed-pdf-viewer/trunk/embed-pdf-viewer.php#L144 - https://wordpress.org/plugins/embed-pdf-viewer/#developers - https://plugins.trac.wordpress.org/changeset/3164573/
CVE ID: CVE-2024-9452 State: PUBLISHED Published: 2024-10-18T04:32:54.219Z Last Updated: 2024-10-18T14:02:23.175Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: lolitaframework Products: Branding Problem Types: CWE-79 Description: The Branding plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. Additional Analyst Notes: - CISA ADP Vulnrichm
scripts in pages that will execute whenever a user accesses the SVG file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8736cf81-3fb8-4c81-a878-7d73a3e68fc2?source=cve - https://wordpress.org/plugins/branding/#developers
CVE ID: CVE-2024-9453 State: PUBLISHED Published: 2025-07-04T08:36:35.184Z Last Updated: 2025-11-20T20:58:14.197Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Red Hat Products: OpenShift Developer Tools and Services Problem Types: CWE-532 Description: A vulnerability was found in Red Hat OpenShift Jenkins. The bearer token is not obfuscated in the logs and potentially carries a high risk if those logs are centralized when collected. The token is typically valid for one year. This flaw allows a malicious user to jeopardize the environment if they have access to sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://
if they have access to sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2024-9453 - https://bugzilla.redhat.com/show_bug.cgi?id=2316231
CVE ID: CVE-2024-9454 State: PUBLISHED Published: 2024-10-26T02:31:31.757Z Last Updated: 2024-10-28T19:13:35.373Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: miyabe Products: PriPre Problem Types: CWE-79 Description: The PriPre plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 0.4.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. Additional Analyst Notes: - CISA ADP Vulnrichment: Refer
pages that will execute whenever a user accesses the SVG file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6662fee4-7e04-492f-bf79-2c915da92c92?source=cve - https://wordpress.org/plugins/pripre/#developers
CVE ID: CVE-2024-9455 State: PUBLISHED Published: 2024-10-05T01:59:40.647Z Last Updated: 2024-10-07T14:20:44.770Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: guillaume-lostweb Products: WP Cleanup and Basic Functions Problem Types: CWE-79 Description: The WP Cleanup and Basic Functions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file
level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/28bdaf44-6f2c-440a-a96f-bdcd71fb7bea?source=cve - https://wordpress.org/plugins/wp-cleanup-and-basic-functions/#developers
CVE ID: CVE-2024-9456 State: PUBLISHED Published: 2024-10-26T04:30:31.547Z Last Updated: 2024-10-28T17:50:07.077Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: elvishp2006 Products: WP Awesome Login Problem Types: CWE-79 Description: The WP Awesome Login plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 0.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. Additional Analyst Notes: - CISA
arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0841127c-fe81-47b1-964f-15e006f618af?source=cve - https://wordpress.org/plugins/wp-awesome-login/#developers
CVE ID: CVE-2024-9457 State: PUBLISHED Published: 2024-10-10T02:05:59.723Z Last Updated: 2024-10-10T13:13:49.041Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: cssjockey Products: WP Builder Problem Types: CWE-79 Description: The WP Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 3.0.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. Additional Analyst Notes: - CISA ADP Vulnrichm
scripts in pages that will execute whenever a user accesses the SVG file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/041c21fb-f2f0-45cb-b3ae-20f3ae22c947?source=cve - https://wordpress.org/plugins/cssjockey-add-ons/#developers
CVE ID: CVE-2024-9458 State: PUBLISHED Published: 2025-03-07T09:38:01.829Z Last Updated: 2025-03-07T14:43:43.877Z Vendors: Unknown Products: Reservit Hotel Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Reservit Hotel WordPress plugin before 3.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/1157d6ae-af8b-4508-97e9-b9e86f612550/
CVE ID: CVE-2024-9459 State: PUBLISHED Published: 2024-11-05T05:44:57.368Z Last Updated: 2024-11-05T16:24:05.731Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L) Vendors: ManageEngine Products: Exchange Reporter Plus Problem Types: CWE-89 Description: Zohocorp ManageEngine Exchange Reporter Plus versions 5718 and prior are vulnerable to authenticated SQL Injection in reports module. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.manageengine.com/products/exchange-reports/advisory/CVE-2024-9459.html
CVE ID: CVE-2024-9460 State: PUBLISHED Published: 2024-10-03T14:31:04.335Z Last Updated: 2024-10-03T15:19:45.418Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Codezips Products: Online Shopping Portal Problem Types: CWE-89 Description: A vulnerability was found in Codezips Online Shopping Portal 1.0. It has been classified as critical. Affected is an unknown function of the file index.php. The manipulation of the argument username leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.279132 - https://vuldb.com/?ct
d. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.279132 - https://vuldb.com/?ctiid.279132 - https://vuldb.com/?submit.417052 - https://github.com/ppp-src/CVE/issues/8
CVE ID: CVE-2024-9461 State: PUBLISHED Published: 2024-11-26T13:56:54.220Z Last Updated: 2024-11-26T14:41:18.738Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: boldgrid Products: Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid Problem Types: CWE-78 Description: The Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.16.6 via the cron_interval parameter. This is due to missing input validation and sanitization. This makes it possible for authenticated attackers, with Administrator-level access and above, to execut
d sanitization. This makes it possible for authenticated attackers, with Administrator-level access and above, to execute code on the server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/804b42a0-1cea-4f68-bd4a-d292a9f23fbe?source=cve - https://plugins.trac.wordpress.org/browser/boldgrid-backup/tags/1.16.5/admin/class-boldgrid-backup-admin-settings.php#L748
CVE ID: CVE-2024-9462 State: PUBLISHED Published: 2024-10-26T01:58:37.041Z Last Updated: 2024-10-28T19:13:54.620Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: ays-pro Products: Poll Maker – Versus Polls, Anonymous Polls, Image Polls Problem Types: CWE-79 Description: The Poll Maker – Versus Polls, Anonymous Polls, Image Polls plugin for WordPress is vulnerable to Stored Cross-Site Scripting via poll settings in all versions up to, and including, 5.4.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that w
authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9e6434fb-390d-439d-bf3e-9afe8644fd58?source=cve - https://plugins.trac.wordpress.org/browser/poll-maker/tags/5.4.6/includes/lists/class-poll-maker-polls-list-table.php#L244 - https://plugins.trac.wordpress.org/browser/poll-maker/tags/5.4.6/includes/lists/class-poll-maker-polls-list-table.php#L255 -
://plugins.trac.wordpress.org/browser/poll-maker/tags/5.4.6/includes/lists/class-poll-maker-polls-list-table.php#L255 - https://plugins.trac.wordpress.org/browser/poll-maker/tags/5.4.6/includes/lists/class-poll-maker-polls-list-table.php#L362
CVE ID: CVE-2024-9463 State: PUBLISHED Published: 2024-10-09T17:03:12.012Z Last Updated: 2025-10-21T22:55:42.730Z Vendors: Palo Alto Networks Products: Expedition Problem Types: CWE-78 Description: An OS command injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to run arbitrary OS commands as root in Expedition, resulting in disclosure of usernames, cleartext passwords, device configurations, and device API keys of PAN-OS firewalls. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.paloaltonetworks.com/PAN-SA-2024-0010
CVE ID: CVE-2024-9464 State: PUBLISHED Published: 2024-10-09T17:03:33.904Z Last Updated: 2024-10-18T15:40:20.097Z Vendors: Palo Alto Networks Products: Expedition Problem Types: CWE-78 Description: An OS command injection vulnerability in Palo Alto Networks Expedition allows an authenticated attacker to run arbitrary OS commands as root in Expedition, resulting in disclosure of usernames, cleartext passwords, device configurations, and device API keys of PAN-OS firewalls. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.paloaltonetworks.com/PAN-SA-2024-0010 - https://www.horizon3.ai/attack-research/palo-alto-expedition-from-n-day-to-full-compromise/
CVE ID: CVE-2024-9465 State: PUBLISHED Published: 2024-10-09T17:04:01.720Z Last Updated: 2025-10-21T22:55:42.570Z Vendors: Palo Alto Networks Products: Expedition Problem Types: CWE-89 Description: An SQL injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to reveal Expedition database contents, such as password hashes, usernames, device configurations, and device API keys. With this, attackers can also create and read arbitrary files on the Expedition system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.paloaltonetworks.com/PAN-SA-2024-0010 - https://www.horizon3.ai/attack-research/palo-alto-expedition-from-n-day-t
curity.paloaltonetworks.com/PAN-SA-2024-0010 - https://www.horizon3.ai/attack-research/palo-alto-expedition-from-n-day-to-full-compromise/
CVE ID: CVE-2024-9466 State: PUBLISHED Published: 2024-10-09T17:04:36.252Z Last Updated: 2025-09-04T15:09:40.127Z Vendors: Palo Alto Networks Products: Expedition Problem Types: CWE-532 Description: A cleartext storage of sensitive information vulnerability in Palo Alto Networks Expedition allows an authenticated attacker to reveal firewall usernames, passwords, and API keys generated using those credentials. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.paloaltonetworks.com/PAN-SA-2024-0010 - https://www.horizon3.ai/attack-research/palo-alto-expedition-from-n-day-to-full-compromise/
CVE ID: CVE-2024-9467 State: PUBLISHED Published: 2024-10-09T17:04:56.867Z Last Updated: 2024-10-18T11:52:07.963Z Vendors: Palo Alto Networks Products: Expedition Problem Types: CWE-79 Description: A reflected XSS vulnerability in Palo Alto Networks Expedition enables execution of malicious JavaScript in the context of an authenticated Expedition user's browser if that user clicks on a malicious link, allowing phishing attacks that could lead to Expedition browser session theft. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.paloaltonetworks.com/PAN-SA-2024-0010
CVE ID: CVE-2024-9468 State: PUBLISHED Published: 2024-10-09T17:05:29.055Z Last Updated: 2025-04-30T18:37:25.963Z Vendors: Palo Alto Networks Products: Cloud NGFW, PAN-OS, Prisma Access Problem Types: CWE-787 Description: A memory corruption vulnerability in Palo Alto Networks PAN-OS software allows an unauthenticated attacker to crash PAN-OS due to a crafted packet through the data plane, resulting in a denial of service (DoS) condition. Repeated attempts to trigger this condition will result in PAN-OS entering maintenance mode. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.paloaltonetworks.com/CVE-2024-9468
CVE ID: CVE-2024-9469 State: PUBLISHED Published: 2024-10-09T17:05:55.091Z Last Updated: 2024-10-18T11:55:36.651Z Vendors: Palo Alto Networks Products: Cortex XDR Agent Problem Types: CWE-754 Description: A problem with a detection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices enables a user with Windows non-administrative privileges to disable the agent. This issue may be leveraged by malware to disable the Cortex XDR agent and then to perform malicious activity. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.paloaltonetworks.com/CVE-2024-9469
CVE ID: CVE-2024-9470 State: PUBLISHED Published: 2024-10-09T17:06:13.944Z Last Updated: 2024-10-18T11:56:57.614Z Vendors: Palo Alto Networks Products: Cortex XSOAR Problem Types: CWE-497 Description: A vulnerability in Cortex XSOAR allows the disclosure of incident data to users who do not have the privilege to view the data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.paloaltonetworks.com/CVE-2024-9470
CVE ID: CVE-2024-9471 State: PUBLISHED Published: 2024-10-09T17:06:41.456Z Last Updated: 2024-10-18T11:58:13.115Z Vendors: Palo Alto Networks Products: PAN-OS, Cloud NGFW, Prisma Access Problem Types: CWE-269 Description: A privilege escalation (PE) vulnerability in the XML API of Palo Alto Networks PAN-OS software enables an authenticated PAN-OS administrator with restricted privileges to use a compromised XML API key to perform actions as a higher privileged PAN-OS administrator. For example, an administrator with "Virtual system administrator (read-only)" access could use an XML API key of a "Virtual system administrator" to perform write operations on the virtual system configuration eve
e an XML API key of a "Virtual system administrator" to perform write operations on the virtual system configuration even though they should be limited to read-only operations. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.paloaltonetworks.com/CVE-2024-9471
CVE ID: CVE-2024-9472 State: PUBLISHED Published: 2024-11-14T09:34:22.665Z Last Updated: 2024-11-14T14:10:30.404Z Vendors: Palo Alto Networks Products: Cloud NGFW, PAN-OS, Prisma Access Problem Types: CWE-476 Description: A null pointer dereference in Palo Alto Networks PAN-OS software on PA-800 Series, PA-3200 Series, PA-5200 Series, and PA-7000 Series hardware platforms when Decryption policy is enabled allows an unauthenticated attacker to crash PAN-OS by sending specific traffic through the data plane, resulting in a denial of service (DoS) condition. Repeated attempts to trigger this condition will result in PAN-OS entering maintenance mode. Palo Alto Networks VM-Series, Cloud NGFW, and