Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-3363 State: PUBLISHED Published: 2024-04-06T08:31:04.945Z Last Updated: 2024-08-01T20:05:08.478Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: SourceCodester Products: Online Library System Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester Online Library System 1.0. It has been classified as critical. This affects an unknown part of the file admin/borrowed/index.php. The manipulation of the argument BookPublisher/BookTitle leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-259467. Additional Anal
disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-259467. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.259467 - https://vuldb.com/?ctiid.259467 - https://vuldb.com/?submit.310429 - https://github.com/thisissuperann/Vul/blob/main/Online-Library-System-05
CVE ID: CVE-2024-3364 State: PUBLISHED Published: 2024-04-06T09:00:05.096Z Last Updated: 2024-08-08T20:26:03.423Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: SourceCodester Products: Online Library System Problem Types: CWE-79 Description: A vulnerability was found in SourceCodester Online Library System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file admin/books/index.php. The manipulation of the argument id leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-259468. Additional Analyst Notes: - CVE Program Con
public and may be used. The identifier of this vulnerability is VDB-259468. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.259468 - https://vuldb.com/?ctiid.259468 - https://vuldb.com/?submit.310431 - https://github.com/thisissuperann/Vul/blob/main/Online-Library-System-06.md
CVE ID: CVE-2024-3365 State: PUBLISHED Published: 2024-04-06T09:31:05.024Z Last Updated: 2024-08-01T20:05:08.508Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: SourceCodester Products: Online Library System Problem Types: CWE-79 Description: A vulnerability was found in SourceCodester Online Library System 1.0. It has been rated as problematic. This issue affects some unknown processing of the file admin/users/controller.php. The manipulation of the argument user_name leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-259469 was assigned to this vulnerability. Additional Analyst No
losed to the public and may be used. The identifier VDB-259469 was assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.259469 - https://vuldb.com/?ctiid.259469 - https://vuldb.com/?submit.310432 - https://github.com/thisissuperann/Vul/blob/main/Online-Library-System-07.md
CVE ID: CVE-2024-3366 State: PUBLISHED Published: 2024-04-06T10:31:04.894Z Last Updated: 2024-08-21T22:32:17.765Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Xuxueli Products: xxl-job Problem Types: CWE-74 Description: A vulnerability classified as problematic was found in Xuxueli xxl-job up to 2.4.1. This vulnerability affects the function deserialize of the file com/xxl/job/core/util/JdkSerializeTool.java of the component Template Handler. The manipulation leads to injection. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-259480. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnri
The identifier of this vulnerability is VDB-259480. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.259480 - https://vuldb.com/?ctiid.259480 - https://vuldb.com/?submit.308180 - https://github.com/xuxueli/xxl-job/issues/3391
CVE ID: CVE-2024-3367 State: PUBLISHED Published: 2024-04-16T11:59:43.845Z Last Updated: 2024-08-26T09:48:37.438Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N) Vendors: Checkmk GmbH Products: Checkmk Problem Types: CWE-88 Description: Argument injection in websphere_mq agent plugin in Checkmk 2.0.0, 2.1.0, <2.2.0p26 and <2.3.0b5 allows local attacker to inject one argument to runmqsc Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://checkmk.com/werk/16615
CVE ID: CVE-2024-3368 State: PUBLISHED Published: 2024-05-20T06:00:01.083Z Last Updated: 2025-03-14T17:20:36.410Z Vendors: Unknown Products: All in One SEO Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The All in One SEO WordPress plugin before 4.6.1.1 does not validate and escape some of its Post fields before outputting them back, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/ab78b1a5-e28c-406b-baaf-6d53017f9328/
CVE ID: CVE-2024-3369 State: PUBLISHED Published: 2024-04-06T11:00:05.805Z Last Updated: 2024-08-01T20:05:08.480Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: code-projects Products: Car Rental Problem Types: CWE-434 Description: A vulnerability, which was classified as critical, has been found in code-projects Car Rental 1.0. Affected by this issue is some unknown functionality of the file add-vehicle.php. The manipulation of the argument Upload Image leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-259490 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA ADP
blic and may be used. VDB-259490 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.259490 - https://vuldb.com/?ctiid.259490 - https://vuldb.com/?submit.311147 - https://drive.google.com/file/d/1wLMnGzcbyCoZ_Wp-bHpLD49MZ9-XHPUK/view?usp=drive_link
CVE ID: CVE-2024-3370 State: PUBLISHED Published: 2024-11-18T12:52:43.902Z Last Updated: 2024-11-18T14:30:55.329Z Vendors: Egebilgi Software Products: Website Template Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Egebilgi Software Website Template allows SQL Injection.This issue affects Website Template: before 29.04.2024. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-24-1860
CVE ID: CVE-2024-3371 State: PUBLISHED Published: 2024-04-24T16:32:07.178Z Last Updated: 2024-08-07T15:29:49.075Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L) Vendors: MongoDB Inc Products: MongoDB Compass Problem Types: CWE-360 Description: MongoDB Compass may accept and use insufficiently validated input from an untrusted external source. This may cause unintended application behavior, including data disclosure and enabling attackers to impersonate users. This issue affects MongoDB Compass versions 1.35.0 to 1.42.0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://jira.mongodb.org/browse/COMPASS-7260
CVE ID: CVE-2024-3372 State: PUBLISHED Published: 2024-05-14T13:24:05.097Z Last Updated: 2024-08-01T20:12:06.488Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: MongoDB Inc Products: MongoDB Server Problem Types: CWE-20 Description: Improper validation of certain metadata input may result in the server not correctly serialising BSON. This can be performed pre-authentication and may cause unexpected application behavior including unavailability of serverStatus responses. This issue affects MongoDB Server v7.0 versions prior to 7.0.6, MongoDB Server v6.0 versions prior to 6.0.14 and MongoDB Server v.5.0 versions prior to 5.0.25. Additional Analyst Notes: - CISA
Server v6.0 versions prior to 6.0.14 and MongoDB Server v.5.0 versions prior to 5.0.25. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://jira.mongodb.org/browse/SERVER-85263
CVE ID: CVE-2024-3373 State: PUBLISHED Published: 2024-09-27T14:14:16.232Z Last Updated: 2024-09-27T16:18:57.238Z Vendors: RSM Design Products: Website Template Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RSM Design Website Template allows SQL Injection.This issue affects Website Template: before 1.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-24-1563
CVE ID: CVE-2024-3374 State: PUBLISHED Published: 2024-05-14T13:26:42.389Z Last Updated: 2024-08-01T20:12:06.214Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: MongoDB Inc Products: MongoDB Server Problem Types: CWE-617 Description: An unauthenticated user can trigger a fatal assertion in the server while generating ftdc diagnostic metrics due to attempting to build a BSON object that exceeds certain memory sizes. This issue affects MongoDB Server v5.0 versions prior to and including 5.0.16 and MongoDB Server v6.0 versions prior to and including 6.0.5. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://jira.mo
cluding 6.0.5. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://jira.mongodb.org/browse/SERVER-75601
CVE ID: CVE-2024-3375 State: PUBLISHED Published: 2024-04-29T09:00:09.149Z Last Updated: 2024-09-26T12:09:54.278Z Severity: CRITICAL (CVSS 9.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H) Vendors: Havelsan Inc. Products: Dialogue Problem Types: CWE-732 Description: Incorrect Permission Assignment for Critical Resource vulnerability in Havelsan Inc. Dialogue allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Dialogue: from v1.83 before v1.83.1 or v1.84. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.usom.gov.tr/bildirim/tr-24-0363
CVE ID: CVE-2024-3376 State: PUBLISHED Published: 2024-04-06T11:31:05.337Z Last Updated: 2025-02-26T18:55:56.693Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: SourceCodester Products: Computer Laboratory Management System Problem Types: CWE-698 Description: A vulnerability classified as critical has been found in SourceCodester Computer Laboratory Management System 1.0. This affects an unknown part of the file config.php. The manipulation of the argument url leads to execution after redirect. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-259497 was assigned to this vulnerability. Additional Ana
en disclosed to the public and may be used. The identifier VDB-259497 was assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.259497 - https://vuldb.com/?ctiid.259497 - https://vuldb.com/?submit.311154 - https://github.com/Sospiro014/zday1/blob/main/Execution_After_Redirect.md
CVE ID: CVE-2024-3377 State: PUBLISHED Published: 2024-04-06T12:00:06.066Z Last Updated: 2024-08-01T20:12:06.615Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: SourceCodester Products: Computer Laboratory Management System Problem Types: CWE-79 Description: A vulnerability classified as problematic was found in SourceCodester Computer Laboratory Management System 1.0. This vulnerability affects unknown code of the file /classes/SystemSettings.php?f=update_settings. The manipulation of the argument name leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-259498 is the identifier assigned to this vu
remotely. The exploit has been disclosed to the public and may be used. VDB-259498 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.259498 - https://vuldb.com/?ctiid.259498 - https://vuldb.com/?submit.311155 - https://github.com/Sospiro014/zday1/blob/main/ear_stord_xss.md
CVE ID: CVE-2024-3378 State: PUBLISHED Published: 2024-04-06T12:31:04.833Z Last Updated: 2024-08-01T20:12:06.521Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: iboss Products: Secure Web Gateway Problem Types: CWE-79 Description: A vulnerability has been found in iboss Secure Web Gateway up to 10.1 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /login of the component Login Portal. The manipulation of the argument redirectUrl leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 10.2.0.160 is able to address this issue. It is rec
s been disclosed to the public and may be used. Upgrading to version 10.2.0.160 is able to address this issue. It is recommended to upgrade the affected component. The identifier VDB-259501 was assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.259501 - https://vuldb.com/?ctiid.259501 - https://vuldb.com/?submit.310642 - https://github.com/modrnProph3t/CVE/blob/main/CVE-2024-3378.md
CVE ID: CVE-2024-3379 State: PUBLISHED Published: 2024-11-14T17:34:26.930Z Last Updated: 2024-11-18T15:54:25.147Z Severity: CRITICAL (CVSS 9.6 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) Vendors: lunary-ai Products: lunary-ai/lunary Problem Types: CWE-863 Description: In lunary-ai/lunary versions 1.2.2 through 1.2.6, an incorrect authorization vulnerability allows unprivileged users to re-generate the private key for projects they do not have access to. Specifically, a user with a 'Member' role can issue a request to regenerate the private key of a project without having the necessary permissions or being assigned to that project. This issue was fixed in version 1.2.7. Additional Analyst N
the necessary permissions or being assigned to that project. This issue was fixed in version 1.2.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/739df024-a112-47aa-b51d-988c3f855e92 - https://github.com/lunary-ai/lunary/commit/c57cd50fa0477fd2a2efe60810c0099eebd66f54
CVE ID: CVE-2024-3380 State: REJECTED Published: N/A Last Updated: 2024-06-07T16:56:03.767Z Description: No description available.
CVE ID: CVE-2024-3381 State: REJECTED Published: N/A Last Updated: 2024-05-27T12:17:06.337Z Description: No description available.
CVE ID: CVE-2024-3382 State: PUBLISHED Published: 2024-04-10T17:05:47.325Z Last Updated: 2024-08-01T20:12:06.637Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Palo Alto Networks Products: PAN-OS, Cloud NGFW, Prisma Access Problem Types: CWE-770 Description: A memory leak exists in Palo Alto Networks PAN-OS software that enables an attacker to send a burst of crafted packets through the firewall that eventually prevents the firewall from processing traffic. This issue applies only to PA-5400 Series devices that are running PAN-OS software with the SSL Forward Proxy feature enabled. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: R
ith the SSL Forward Proxy feature enabled. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://security.paloaltonetworks.com/CVE-2024-3382
CVE ID: CVE-2024-3383 State: PUBLISHED Published: 2024-04-10T17:06:15.823Z Last Updated: 2024-08-09T20:22:18.991Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H) Vendors: Palo Alto Networks Products: PAN-OS, Cloud NGFW, Prisma Access Problem Types: CWE-282 Description: A vulnerability in how Palo Alto Networks PAN-OS software processes data received from Cloud Identity Engine (CIE) agents enables modification of User-ID groups. This impacts user access to network resources where users may be inappropriately denied or allowed access to resources based on your existing Security Policy rules. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Refe
on your existing Security Policy rules. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.paloaltonetworks.com/CVE-2024-3383
CVE ID: CVE-2024-3384 State: PUBLISHED Published: 2024-04-10T17:06:21.704Z Last Updated: 2024-08-01T20:12:06.484Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Palo Alto Networks Products: PAN-OS, Cloud NGFW, Prisma Access Problem Types: CWE-1286 Description: A vulnerability in Palo Alto Networks PAN-OS software enables a remote attacker to reboot PAN-OS firewalls when receiving Windows New Technology LAN Manager (NTLM) packets from Windows servers. Repeated attacks eventually cause the firewall to enter maintenance mode, which requires manual intervention to bring the firewall back online. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Con
ual intervention to bring the firewall back online. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://security.paloaltonetworks.com/CVE-2024-3384
CVE ID: CVE-2024-3385 State: PUBLISHED Published: 2024-04-10T17:06:28.153Z Last Updated: 2024-08-22T18:10:55.925Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Palo Alto Networks Products: PAN-OS, Cloud NGFW, Prisma Access Problem Types: CWE-20, CWE-476 Description: A packet processing mechanism in Palo Alto Networks PAN-OS software enables a remote attacker to reboot hardware-based firewalls. Repeated attacks eventually cause the firewall to enter maintenance mode, which requires manual intervention to bring the firewall back online. This affects the following hardware firewall models: - PA-5400 Series firewalls - PA-7000 Series firewalls Additional Analyst
affects the following hardware firewall models: - PA-5400 Series firewalls - PA-7000 Series firewalls Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.paloaltonetworks.com/CVE-2024-3385
CVE ID: CVE-2024-3386 State: PUBLISHED Published: 2024-04-10T17:06:32.694Z Last Updated: 2024-08-01T20:12:06.667Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: Palo Alto Networks Products: PAN-OS, Cloud NGFW, Prisma Access Problem Types: CWE-436 Description: An incorrect string comparison vulnerability in Palo Alto Networks PAN-OS software prevents Predefined Decryption Exclusions from functioning as intended. This can cause traffic destined for domains that are not specified in Predefined Decryption Exclusions to be unintentionally excluded from decryption. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://s
ded from decryption. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://security.paloaltonetworks.com/CVE-2024-3386
CVE ID: CVE-2024-3387 State: PUBLISHED Published: 2024-04-10T17:06:36.676Z Last Updated: 2024-08-01T20:12:06.646Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: Palo Alto Networks Products: PAN-OS, Cloud NGFW, Prisma Access Problem Types: CWE-326 Description: A weak (low bit strength) device certificate in Palo Alto Networks Panorama software enables an attacker to perform a meddler-in-the-middle (MitM) attack to capture encrypted traffic between the Panorama management server and the firewalls it manages. With sufficient computing resources, the attacker could break encrypted communication and expose sensitive information that is shared between the managem
es, the attacker could break encrypted communication and expose sensitive information that is shared between the management server and the firewalls. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://security.paloaltonetworks.com/CVE-2024-3387
CVE ID: CVE-2024-3388 State: PUBLISHED Published: 2024-04-10T17:06:40.685Z Last Updated: 2024-08-01T20:12:06.617Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N) Vendors: Palo Alto Networks Products: PAN-OS, Cloud NGFW, Prisma Access Problem Types: CWE-269, CWE-863 Description: A vulnerability in the GlobalProtect Gateway in Palo Alto Networks PAN-OS software enables an authenticated attacker to impersonate another user and send network packets to internal assets. However, this vulnerability does not allow the attacker to receive response packets from those internal assets. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - http
om those internal assets. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://security.paloaltonetworks.com/CVE-2024-3388
CVE ID: CVE-2024-3393 State: PUBLISHED Published: 2024-12-27T09:44:24.538Z Last Updated: 2025-10-21T22:55:33.618Z Vendors: Palo Alto Networks Products: Cloud NGFW, PAN-OS Problem Types: CWE-754 Description: A Denial of Service vulnerability in the DNS Security feature of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to send a malicious packet through the data plane of the firewall that reboots the firewall. Repeated attempts to trigger this condition will cause the firewall to enter maintenance mode. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.paloaltonetworks.com/CVE-2024-3393
CVE ID: CVE-2024-3400 State: PUBLISHED Published: 2024-04-12T07:20:00.707Z Last Updated: 2025-10-21T23:05:21.315Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Palo Alto Networks Products: PAN-OS, Cloud NGFW, Prisma Access Problem Types: CWE-77, CWE-20 Description: A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurations may enable an unauthenticated attacker to execute arbitrary code with root privileges on the firewall. Cloud NGFW, Panorama appliances, and Prisma Access are not impacted by this vulnerability
ot privileges on the firewall. Cloud NGFW, Panorama appliances, and Prisma Access are not impacted by this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://security.paloaltonetworks.com/CVE-2024-3400 - https://unit42.paloaltonetworks.com/cve-2024-3400/ - https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/ - https://www.paloaltonetworks.com/blog/2024/04/more-on-the-pan-os-cve/
CVE ID: CVE-2024-3402 State: PUBLISHED Published: 2024-06-06T18:24:03.274Z Last Updated: 2024-08-01T20:12:06.645Z Severity: MEDIUM (CVSS 6.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N) Vendors: gaizhenbiao Products: gaizhenbiao/chuanhuchatgpt Problem Types: CWE-79 Description: A stored Cross-Site Scripting (XSS) vulnerability existed in version (20240121) of gaizhenbiao/chuanhuchatgpt due to inadequate sanitization and validation of model output data. Despite user-input validation efforts, the application fails to properly sanitize or validate the output from the model, allowing for the injection and execution of malicious JavaScript code within the context of a user's browser. This vulner