Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-45161 State: PUBLISHED Published: 2025-10-29T00:00:00.000Z Last Updated: 2025-10-29T14:29:46.131Z Vendors: n/a Products: n/a Problem Types: n/a Description: A CSRF issue was discovered in the administrative web GUI in Blu-Castle BCUM221E 1.0.0P220507. This can be exploited via a URL, an image load, an XMLHttpRequest, etc. and can result in exposure of data or unintended code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://blu-castle.com/ - https://www.gruppotim.it/it/footer/red-team/2024/CVE-2024-45161-Blu-Castle_BCUM221E.html
CVE ID: CVE-2024-45162 State: PUBLISHED Published: 2025-10-29T00:00:00.000Z Last Updated: 2025-10-29T14:19:18.542Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stack-based buffer overflow issue was discovered in the phddns client in Blu-Castle BCUM221E 1.0.0P220507 via the password field. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://blu-castle.com/ - https://www.gruppotim.it/it/footer/red-team/2024/CVE-2024-45162-Blu-Castle_BCUM221E1.html
CVE ID: CVE-2024-45163 State: PUBLISHED Published: 2024-08-22T00:00:00 Last Updated: 2024-08-22T14:25:59.452Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Mirai botnet through 2024-08-19 mishandles simultaneous TCP connections to the CNC (command and control) server. Unauthenticated sessions remain open, causing resource consumption. For example, an attacker can send a recognized username (such as root), or can send arbitrary data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cypressthatkid.medium.com/remote-dos-exploit-found-in-mirai-botnet-source-code-27a1aad284f1 - https://pastebin.com/6tqHnCva - https://youtu.be/aJkvSr85ML8
CVE ID: CVE-2024-45164 State: PUBLISHED Published: 2024-11-04T00:00:00 Last Updated: 2024-11-06T16:18:38.490Z Vendors: n/a Products: n/a Problem Types: n/a Description: Akamai SIA (Secure Internet Access Enterprise) ThreatAvert, in SPS (Security and Personalization Services) before the latest 19.2.0 patch and Apps Portal before 19.2.0.3 or 19.2.0.20240814, has incorrect authorization controls for the Admin functionality on the ThreatAvert Policy page. An authenticated user can navigate directly to the /#app/intelligence/threatAvertPolicies URI and disable policy enforcement. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.akamai.com/global-services/support/vulner
. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.akamai.com/global-services/support/vulnerability-reporting - https://notes.netbytesec.com/2024/11/cve-2024-45164-broken-access-control.html
CVE ID: CVE-2024-45165 State: PUBLISHED Published: 2024-08-22T00:00:00 Last Updated: 2024-10-31T18:17:04.946Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in UCI IDOL 2 (aka uciIDOL or IDOL2) through 2.12. Data is sent between client and server with encryption. However, the key is derived from the string "(c)2007 UCI Software GmbH B.Boll" (without quotes). The key is both static and hardcoded. With access to messages, this results in message decryption and encryption by an attacker. Thus, it enables passive and active man-in-the-middle attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.syss.de/en/responsible-disclosure-
attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.syss.de/en/responsible-disclosure-policy - https://uci.de/products/index.html - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-048.txt - https://uci.de/download/idol2-client.html - http://download.uci.de/idol2/idol2Client_2_12.exe
CVE ID: CVE-2024-45166 State: PUBLISHED Published: 2024-08-22T00:00:00 Last Updated: 2024-08-22T13:18:38.592Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in UCI IDOL 2 (aka uciIDOL or IDOL2) through 2.12. Due to improper input validation, improper deserialization, and improper restriction of operations within the bounds of a memory buffer, IDOL2 is vulnerable to Denial-of-Service (DoS) attacks and possibly remote code execution. There is an access violation and EIP overwrite after five logins. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.syss.de/en/responsible-disclosure-policy - https://uci.de/products/index.html - https
ichment: References: - https://www.syss.de/en/responsible-disclosure-policy - https://uci.de/products/index.html - https://uci.de/download/idol2-client.html - http://download.uci.de/idol2/idol2Client_2_12.exe - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-050.txt
CVE ID: CVE-2024-45167 State: PUBLISHED Published: 2024-08-22T00:00:00 Last Updated: 2024-08-22T20:02:43.672Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in UCI IDOL 2 (aka uciIDOL or IDOL2) through 2.12. Due to improper input validation, improper deserialization, and improper restriction of operations within the bounds of a memory buffer, IDOL2 is vulnerable to Denial-of-Service (DoS) attacks and possibly remote code execution. A certain XmlMessage document causes 100% CPU consumption. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.syss.de/en/responsible-disclosure-policy - https://uci.de/products/index.html - https://uci.
: References: - https://www.syss.de/en/responsible-disclosure-policy - https://uci.de/products/index.html - https://uci.de/download/idol2-client.html - http://download.uci.de/idol2/idol2Client_2_12.exe - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-050.txt - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-051.txt
CVE ID: CVE-2024-45168 State: PUBLISHED Published: 2024-08-22T00:00:00 Last Updated: 2024-08-22T13:36:52.712Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in UCI IDOL 2 (aka uciIDOL or IDOL2) through 2.12. Data is transferred over a raw socket without any authentication mechanism. Thus, communication endpoints are not verifiable. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.syss.de/en/responsible-disclosure-policy - https://uci.de/products/index.html - https://uci.de/download/idol2-client.html - http://download.uci.de/idol2/idol2Client_2_12.exe - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-04
wnload.uci.de/idol2/idol2Client_2_12.exe - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-049.txt
CVE ID: CVE-2024-45169 State: PUBLISHED Published: 2024-08-22T00:00:00 Last Updated: 2024-08-22T14:37:58.392Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in UCI IDOL 2 (aka uciIDOL or IDOL2) through 2.12. Due to improper input validation, improper deserialization, and improper restriction of operations within the bounds of a memory buffer, IDOL2 is vulnerable to Denial-of-Service (DoS) attacks and possibly remote code execution via the \xB0\x00\x3c byte sequence. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.syss.de/en/responsible-disclosure-policy - https://uci.de/products/index.html - https://uci.de/download/idol2-client
www.syss.de/en/responsible-disclosure-policy - https://uci.de/products/index.html - https://uci.de/download/idol2-client.html - http://download.uci.de/idol2/idol2Client_2_12.exe - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-052.txt
CVE ID: CVE-2024-45170 State: PUBLISHED Published: 2024-09-04T00:00:00 Last Updated: 2024-09-06T06:03:34.402Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in za-internet C-MOR Video Surveillance 5.2401. Due to improper or missing access control, low privileged users can use administrative functions of the C-MOR web interface. It was found out that different functions are only available to administrative users. However, access those functions is restricted via the web application user interface and not checked on the server side. Thus, by sending corresponding HTTP requests to the web server of the C-MOR web interface, low privileged users can also use ad
y sending corresponding HTTP requests to the web server of the C-MOR web interface, low privileged users can also use administrative functionality, for instance downloading backup files or changing configuration settings. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-024.txt - https://www-syss-de.translate.goog/pentest-blog/mehrere-sicherheitsschwachstellen-in-videoueberwachungssoftware-c-mor-syss-2024-020-bis-030?_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=en-US&_x_tr_pto=wapp
CVE ID: CVE-2024-45171 State: PUBLISHED Published: 2024-09-05T00:00:00 Last Updated: 2024-09-06T06:03:35.338Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in za-internet C-MOR Video Surveillance 5.2401. Due to improper user input validation, it is possible to upload dangerous files, for instance PHP code, to the C-MOR system. By analyzing the C-MOR web interface, it was found out that the upload functionality for backup files allows an authenticated user to upload arbitrary files. The only condition is that the filename contains a .cbkf string. Therefore, webshell.cbkf.php is considered a valid file name for the C-MOR web application. Uploaded files are
string. Therefore, webshell.cbkf.php is considered a valid file name for the C-MOR web application. Uploaded files are stored within the directory "/srv/www/backups" on the C-MOR system, and can thus be accessed via the URL https://<HOST>/backup/upload_<FILENAME>. Due to broken access control, low-privileged authenticated users can also use this file upload functionality. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-026.txt - https://www.syss.de/pentest-blog/mehrere-sicherheitsschwachstellen-in-videoueberwachungssoftware-c-mor-syss-2024-020-bis-030
CVE ID: CVE-2024-45172 State: PUBLISHED Published: 2024-09-04T00:00:00 Last Updated: 2024-09-06T06:03:36.295Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in za-internet C-MOR Video Surveillance 5.2401 and 6.00PL01. Due to missing protection mechanisms, the C-MOR web interface is vulnerable to cross-site request forgery (CSRF) attacks. The C-MOR web interface offers no protection against cross-site request forgery (CSRF) attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-022.txt - https://www.syss.de/pentest-blog/mehrere-sicherheitss
e/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-022.txt - https://www.syss.de/pentest-blog/mehrere-sicherheitsschwachstellen-in-videoueberwachungssoftware-c-mor-syss-2024-020-bis-030
CVE ID: CVE-2024-45173 State: PUBLISHED Published: 2024-09-05T00:00:00 Last Updated: 2024-09-06T06:03:37.222Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in za-internet C-MOR Video Surveillance 5.2401. Due to improper privilege management concerning sudo privileges, C-MOR is vulnerable to a privilege escalation attack. The Linux user www-data running the C-MOR web interface can execute some OS commands as root via Sudo without having to enter the root password. These commands, for example, include cp, chown, and chmod, which enable an attacker to modify the system's sudoers file in order to execute all commands with root privileges. Thus, it is possible
attacker to modify the system's sudoers file in order to execute all commands with root privileges. Thus, it is possible to escalate the limited privileges of the user www-data to root privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-027.txt - https://www.syss.de/pentest-blog/mehrere-sicherheitsschwachstellen-in-videoueberwachungssoftware-c-mor-syss-2024-020-bis-030
CVE ID: CVE-2024-45174 State: PUBLISHED Published: 2024-09-04T00:00:00 Last Updated: 2024-09-06T06:03:38.138Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in za-internet C-MOR Video Surveillance 5.2401 and 6.00PL01. Due to improper validation of user-supplied data, different functionalities of the C-MOR web interface are vulnerable to SQL injection attacks. This kind of attack allows an authenticated user to execute arbitrary SQL commands in the context of the corresponding MySQL database. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-02
nt: - CVE Program Container: References: - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-023.txt - https://www.syss.de/pentest-blog/mehrere-sicherheitsschwachstellen-in-videoueberwachungssoftware-c-mor-syss-2024-020-bis-030
CVE ID: CVE-2024-45175 State: PUBLISHED Published: 2024-09-05T00:00:00 Last Updated: 2024-09-06T07:02:41.240Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in za-internet C-MOR Video Surveillance 5.2401. Sensitive information is stored in cleartext. It was found out that sensitive information, for example login credentials of cameras, is stored in cleartext. Thus, an attacker with filesystem access, for example exploiting a path traversal attack, has access to the login data of all configured cameras, or the configured FTP server. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.syss.de/fileadmin/dokume
onal Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-028.txt - https://www.syss.de/pentest-blog/mehrere-sicherheitsschwachstellen-in-videoueberwachungssoftware-c-mor-syss-2024-020-bis-030
CVE ID: CVE-2024-45176 State: PUBLISHED Published: 2024-09-05T00:00:00.000Z Last Updated: 2025-03-17T21:59:21.904Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in za-internet C-MOR Video Surveillance 5.2401. Due to improper input validation, the C-MOR web interface is vulnerable to reflected cross-site scripting (XSS) attacks. It was found out that different functions are prone to reflected cross-site scripting attacks due to insufficient user input validation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-020.txt - https://www.syss.de/p
References: - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-020.txt - https://www.syss.de/pentest-blog/mehrere-sicherheitsschwachstellen-in-videoueberwachungssoftware-c-mor-syss-2024-020-bis-030
CVE ID: CVE-2024-45177 State: PUBLISHED Published: 2024-09-04T00:00:00 Last Updated: 2024-09-06T06:03:39.071Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in za-internet C-MOR Video Surveillance 5.2401 and 6.00PL01. Due to improper input validation, the C-MOR web interface is vulnerable to persistent cross-site scripting (XSS) attacks. It was found out that the camera configuration is vulnerable to a persistent cross-site scripting attack due to insufficient user input validation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-021.txt - h
Program Container: References: - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-021.txt - https://www.syss.de/pentest-blog/mehrere-sicherheitsschwachstellen-in-videoueberwachungssoftware-c-mor-syss-2024-020-bis-030
CVE ID: CVE-2024-45178 State: PUBLISHED Published: 2024-09-05T00:00:00 Last Updated: 2024-09-06T06:03:40.047Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in za-internet C-MOR Video Surveillance 5.2401. Due to improper user input validation, it is possible to download arbitrary files from the C-MOR system via a path traversal attack. It was found out that different functionalities are vulnerable to path traversal attacks, due to insufficient user input validation. For instance, the download functionality for backups provided by the script download-bkf.pml is vulnerable to a path traversal attack via the parameter bkf. This enables an authenticated user t
pt download-bkf.pml is vulnerable to a path traversal attack via the parameter bkf. This enables an authenticated user to download arbitrary files as Linux user www-data from the C-MOR system. Another path traversal attack is in the script show-movies.pml, which can be exploited via the parameter cam. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-025.txt - https://www.syss.de/pentest-blog/mehrere-sicherheitsschwachstellen-in-videoueberwachungssoftware-c-mor-syss-2024-020-bis-030
CVE ID: CVE-2024-45179 State: PUBLISHED Published: 2024-10-09T00:00:00 Last Updated: 2024-10-09T14:07:50.564Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in za-internet C-MOR Video Surveillance 5.2401 and 6.00PL01. Due to insufficient input validation, the C-MOR web interface is vulnerable to OS command injection attacks. It was found out that different functionality is vulnerable to OS command injection attacks, for example for generating new X.509 certificates, or setting the time zone. These OS command injection vulnerabilities in the script generatesslreq.pml can be exploited as a low-privileged authenticated user to execute commands in the context
he script generatesslreq.pml can be exploited as a low-privileged authenticated user to execute commands in the context of the Linux user www-data via shell metacharacters in HTTP POST data (e.g., the city parameter). The OS command injection vulnerability in the script settimezone.pml or setdatetime.pml (e.g., via the year parameter) requires an administrative user for the C-MOR web interface. By also exploiting a privilege-escalation vulnerability, it is possible to execute commands on the C-MOR system with root privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-030
r: - CISA ADP Vulnrichment: References: - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-030.txt
CVE ID: CVE-2024-45180 State: PUBLISHED Published: 2024-09-03T00:00:00.000Z Last Updated: 2025-03-18T13:33:44.833Z Vendors: n/a Products: n/a Problem Types: n/a Description: SquaredUp DS for SCOM 6.2.1.11104 allows XSS. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://squaredup.com - https://scomsupport.squaredup.com/reference/security-advisory/cve-2024-45180-stored-cross-site-scripting-knowledge-editor-tile
CVE ID: CVE-2024-45181 State: PUBLISHED Published: 2024-09-12T00:00:00 Last Updated: 2024-09-12T19:49:11.501Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in WibuKey64.sys in WIBU-SYSTEMS WibuKey before v6.70 and fixed in v.6.70. An improper bounds check allows crafted packets to cause an arbitrary address write, resulting in kernel memory corruption. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wibu.com - https://cdn.wibu.com/fileadmin/wibu_downloads/security_advisories/AdvisoryWIBU-94453.pdf
CVE ID: CVE-2024-45182 State: PUBLISHED Published: 2024-09-12T00:00:00 Last Updated: 2024-10-29T20:14:05.302Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in WibuKey64.sys in WIBU-SYSTEMS WibuKey before v6.70 and fixed in v.6.70 An improper bounds check allows specially crafted packets to cause an arbitrary address read, resulting in Denial of Service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wibu.com - https://cdn.wibu.com/fileadmin/wibu_downloads/security_advisories/AdvisoryWIBU-94453.pdf
CVE ID: CVE-2024-45183 State: PUBLISHED Published: 2025-08-04T00:00:00.000Z Last Updated: 2025-08-04T19:41:10.422Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Samsung Mobile Processor Exynos 2100, 1280, 2200, 1330, 1380, 1480, and 2400. A lack of a JPEG length check leads to an out-of-bound write. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://semiconductor.samsung.com/support/quality-support/product-security-updates/ - https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2024-45183/
CVE ID: CVE-2024-45184 State: PUBLISHED Published: 2024-10-11T00:00:00 Last Updated: 2024-11-06T17:03:29.730Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modems with chipset Exynos 9820, 9825, 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 9110, W920, W930, Modem 5123, and Modem 5300. A USAT out-of-bounds write due to a heap buffer overflow can lead to a Denial of Service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://semiconductor.samsung.com/support/quality-support/product-security-updates/ - https://semiconductor.samsung.com/support/quality-support/product
om/support/quality-support/product-security-updates/ - https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2024-45184/
CVE ID: CVE-2024-45185 State: PUBLISHED Published: 2024-11-04T00:00:00 Last Updated: 2024-11-06T18:54:26.362Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 9820, 9825, 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 9110, W920, W930, Modem 5123, Modem 5300. There is an out-of-bounds write due to a heap overflow in the GPRS protocol. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://semiconductor.samsung.com/support/quality-support/product-security-updates/ - https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2024-4518
uct-security-updates/ - https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2024-45185/
CVE ID: CVE-2024-45186 State: PUBLISHED Published: 2024-10-02T00:00:00 Last Updated: 2024-10-02T14:04:49.245Z Vendors: n/a Products: n/a Problem Types: n/a Description: FileSender before 2.49 allows server-side template injection (SSTI) for retrieving credentials. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://filesender.org/vulnerability-in-filesender-versions-below-2-49-and-3-x-beta/
CVE ID: CVE-2024-45187 State: PUBLISHED Published: 2024-08-23T18:58:59.693Z Last Updated: 2024-11-25T12:40:10.567Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Problem Types: CWE-613 Description: Guest users in the Mage AI framework that remain logged in after their accounts are deleted, are mistakenly given high privileges and specifically given access to remotely execute arbitrary code through the Mage AI terminal server Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://research.jfrog.com/vulnerabilities/mage-ai-deleted-users-rce-jfsa-2024-001039602/
CVE ID: CVE-2024-45188 State: PUBLISHED Published: 2024-08-23T19:14:59.812Z Last Updated: 2024-11-25T12:42:16.990Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Problem Types: CWE-22 Description: Mage AI allows remote users with the "Viewer" role to leak arbitrary files from the Mage server due to a path traversal in the "File Content" request Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://research.jfrog.com/vulnerabilities/mage-ai-file-content-request-remote-arbitrary-file-leak-jfsa-2024-001039603/