Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-38460 State: PUBLISHED Published: 2024-06-16T00:00:00.000Z Last Updated: 2025-03-13T14:12:15.939Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AC:L/AV:N/A:N/C:H/I:N/PR:H/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: In SonarQube before 10.4 and 9.9.4 LTA, encrypted values generated using the Settings Encryption feature are potentially exposed in cleartext as part of the URL parameters in the logs (such as SonarQube Access Logs, Proxy Logs, etc). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://sonarsource.atlassian.net/browse/SONAR-21559 - https://community.sonarsource.com/t/sonarqube-ce-10-3-0-leaking-encrypted-
onarsource.atlassian.net/browse/SONAR-21559 - https://community.sonarsource.com/t/sonarqube-ce-10-3-0-leaking-encrypted-values-in-web-server-logs/108187
CVE ID: CVE-2024-38461 State: PUBLISHED Published: 2024-06-16T00:00:00 Last Updated: 2024-10-30T19:06:47.188Z Vendors: n/a Products: n/a Problem Types: n/a Description: irodsServerMonPerf in iRODS before 4.3.2 attempts to proceed with use of a path even if it is not a directory. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/irods/irods/issues/7652 - https://github.com/irods/irods/releases/tag/4.3.2 - https://irods.org/2024/05/irods-4-3-2-is-released
CVE ID: CVE-2024-38462 State: PUBLISHED Published: 2024-06-16T00:00:00 Last Updated: 2024-08-21T14:18:26.595Z Vendors: n/a Products: n/a Problem Types: n/a Description: iRODS before 4.3.2 provides an msiSendMail function with a problematic dependency on the mail binary, such as in the mailMS.cpp#L94-L106 reference. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/irods/irods/issues/7651 - https://github.com/irods/irods/issues/7562 - https://irods.org/2024/05/irods-4-3-2-is-released/ - https://github.com/irods/irods/blob/97eb33f130349db5e01a4b85e89dd1da81460345/server/re/src/mailMS.cpp#L94-L106
CVE ID: CVE-2024-38465 State: PUBLISHED Published: 2024-06-16T00:00:00.000Z Last Updated: 2025-03-14T00:39:39.663Z Vendors: n/a Products: n/a Problem Types: n/a Description: Shenzhen Guoxin Synthesis image system before 8.3.0 allows username enumeration because of the response discrepancy of incorrect versus error. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Pumpkin-ito/Cve-Vuln/blob/main/Guosen%20synthetic%20imaging%20system%20vulnerability.pdf
CVE ID: CVE-2024-38466 State: PUBLISHED Published: 2024-06-16T00:00:00.000Z Last Updated: 2025-03-19T20:05:19.469Z Vendors: n/a Products: n/a Problem Types: n/a Description: Shenzhen Guoxin Synthesis image system before 8.3.0 has a 123456Qw default password. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/Pumpkin-ito/Cve-Vuln/blob/main/Guosen%20synthetic%20imaging%20system%20vulnerability.pdf
CVE ID: CVE-2024-38467 State: PUBLISHED Published: 2024-06-16T00:00:00 Last Updated: 2024-08-02T04:12:24.801Z Vendors: n/a Products: n/a Problem Types: n/a Description: Shenzhen Guoxin Synthesis image system before 8.3.0 allows unauthorized user information retrieval via the queryUser API. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/Pumpkin-ito/Cve-Vuln/blob/main/Guosen%20synthetic%20imaging%20system%20vulnerability.pdf
CVE ID: CVE-2024-38468 State: PUBLISHED Published: 2024-06-16T00:00:00.000Z Last Updated: 2025-03-26T15:52:27.653Z Vendors: n/a Products: n/a Problem Types: n/a Description: Shenzhen Guoxin Synthesis image system before 8.3.0 allows unauthorized password resets via the resetPassword API. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/Pumpkin-ito/Cve-Vuln/blob/main/Guosen%20synthetic%20imaging%20system%20vulnerability.pdf
CVE ID: CVE-2024-38469 State: PUBLISHED Published: 2024-06-17T00:00:00 Last Updated: 2024-08-02T04:12:24.572Z Vendors: n/a Products: n/a Problem Types: n/a Description: zhimengzhe iBarn v1.5 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the $search parameter at /pay.php. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/zhimengzhe/iBarn - https://github.com/zhimengzhe/iBarn/issues/20
CVE ID: CVE-2024-38470 State: PUBLISHED Published: 2024-06-17T00:00:00 Last Updated: 2024-08-02T04:12:24.754Z Vendors: n/a Products: n/a Problem Types: n/a Description: zhimengzhe iBarn v1.5 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the $search parameter at /own.php. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/zhimengzhe/iBarn - https://github.com/zhimengzhe/iBarn/issues/20
CVE ID: CVE-2024-38471 State: PUBLISHED Published: 2024-07-04T00:49:13.216Z Last Updated: 2025-03-13T13:17:03.724Z Vendors: TP-LINK Products: Archer AX3000, Archer AXE75, Archer AX5400, Archer Air R5, Archer AXE5400 Problem Types: OS command injection Description: Multiple TP-LINK products allow a network-adjacent attacker with an administrative privilege to execute arbitrary OS commands by restoring a crafted backup file. The affected device, with the initial configuration, allows login only from the LAN port or Wi-Fi. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.tp-link.com/jp/support/download/ - https://www.tp-link.com/jp/support/do
VE Program Container: References: - https://www.tp-link.com/jp/support/download/ - https://www.tp-link.com/jp/support/download/archer-ax3000/#Firmware - https://www.tp-link.com/jp/support/download/archer-axe75/#Firmware - https://www.tp-link.com/jp/support/download/archer-ax5400/#Firmware - https://www.tp-link.com/jp/support/download/archer-air-r5/v1/#Firmware - https://www.tp-link.com/jp/support/download/archer-axe5400/#Firmware - https://jvn.jp/en/vu/JVNVU99784493/
CVE ID: CVE-2024-38472 State: PUBLISHED Published: 2024-07-01T18:12:27.616Z Last Updated: 2024-11-18T08:51:23.206Z Vendors: Apache Software Foundation Products: Apache HTTP Server Problem Types: CWE-918 Description: SSRF in Apache HTTP Server on Windows allows to potentially leak NTLM hashes to a malicious server via SSRF and malicious requests or content Users are recommended to upgrade to version 2.4.60 which fixes this issue. Note: Existing configurations that access UNC paths will have to configure new directive "UNCList" to allow access during request processing. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://httpd.apache.org/security/v
ional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://httpd.apache.org/security/vulnerabilities_24.html
CVE ID: CVE-2024-38473 State: PUBLISHED Published: 2024-07-01T18:14:21.520Z Last Updated: 2025-02-13T17:53:12.372Z Vendors: Apache Software Foundation Products: Apache HTTP Server Problem Types: CWE-116 Description: Encoding problem in mod_proxy in Apache HTTP Server 2.4.59 and earlier allows request URLs with incorrect encoding to be sent to backend services, potentially bypassing authentication via crafted requests. Users are recommended to upgrade to version 2.4.60, which fixes this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://httpd.apache.org/security/vulnerabilities_24.html - https://security.netapp.com/advisory/ntap-20240712-0
nces: - https://httpd.apache.org/security/vulnerabilities_24.html - https://security.netapp.com/advisory/ntap-20240712-0001/
CVE ID: CVE-2024-38474 State: PUBLISHED Published: 2024-07-01T18:14:47.004Z Last Updated: 2025-03-25T18:24:03.613Z Vendors: Apache Software Foundation Products: Apache HTTP Server Problem Types: CWE-116 Description: Substitution encoding issue in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows attacker to execute scripts in directories permitted by the configuration but not directly reachable by any URL or source disclosure of scripts meant to only to be executed as CGI. Users are recommended to upgrade to version 2.4.60, which fixes this issue. Some RewriteRules that capture and substitute unsafely will now fail unless rewrite flag "UnsafeAllow3F" is specified. Additional Analys
s that capture and substitute unsafely will now fail unless rewrite flag "UnsafeAllow3F" is specified. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://httpd.apache.org/security/vulnerabilities_24.html - https://security.netapp.com/advisory/ntap-20240712-0001/
CVE ID: CVE-2024-38475 State: PUBLISHED Published: 2024-07-01T18:15:12.292Z Last Updated: 2025-11-03T21:55:40.951Z Vendors: Apache Software Foundation Products: Apache HTTP Server Problem Types: CWE-116 Description: Improper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure. Substitutions in server context that use a backreferences or variables as the first segment of the substitution are affected. Some unsafe RewiteRules will be broken by this change and the
les as the first segment of the substitution are affected. Some unsafe RewiteRules will be broken by this change and the rewrite flag "UnsafePrefixStat" can be used to opt back in once ensuring the substitution is appropriately constrained. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://httpd.apache.org/security/vulnerabilities_24.html - https://security.netapp.com/advisory/ntap-20240712-0001/
CVE ID: CVE-2024-38476 State: PUBLISHED Published: 2024-07-01T18:15:40.071Z Last Updated: 2025-11-03T21:55:42.872Z Vendors: Apache Software Foundation Products: Apache HTTP Server Problem Types: CWE-829 Description: Vulnerability in core of Apache HTTP Server 2.4.59 and earlier are vulnerably to information disclosure, SSRF or local script execution via backend applications whose response headers are malicious or exploitable. Users are recommended to upgrade to version 2.4.60, which fixes this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://httpd.apache.org/security/vulnerabilities_24.html - https://security.netapp.com/advisory/ntap-20
: References: - https://httpd.apache.org/security/vulnerabilities_24.html - https://security.netapp.com/advisory/ntap-20240712-0001/
CVE ID: CVE-2024-38477 State: PUBLISHED Published: 2024-07-01T18:16:11.935Z Last Updated: 2025-11-03T21:55:44.577Z Vendors: Apache Software Foundation Products: Apache HTTP Server Problem Types: CWE-476 Description: null pointer dereference in mod_proxy in Apache HTTP Server 2.4.59 and earlier allows an attacker to crash the server via a malicious request. Users are recommended to upgrade to version 2.4.60, which fixes this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://httpd.apache.org/security/vulnerabilities_24.html - https://security.netapp.com/advisory/ntap-20240712-0001/
CVE ID: CVE-2024-38479 State: PUBLISHED Published: 2024-11-14T09:52:14.291Z Last Updated: 2025-11-03T20:38:05.702Z Vendors: Apache Software Foundation Products: Apache Traffic Server Problem Types: CWE-20 Description: Improper Input Validation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.5. Users are recommended to upgrade to version 9.2.6, which fixes the issue, or 10.0.2, which does not have the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lists.apache.org/thread/y15fh6c7kyqvzm0f9odw7c5jh4r4np0y
CVE ID: CVE-2024-38480 State: PUBLISHED Published: 2024-07-01T02:27:01.945Z Last Updated: 2024-11-12T17:15:57.289Z Vendors: Kakao piccoma Corp. Products: "Piccoma" App for Android, "Piccoma" App for iOS Problem Types: Use of Hard-coded Credentials Description: "Piccoma" App for Android and iOS versions prior to 6.20.0 uses a hard-coded API key for an external service, which may allow a local attacker to obtain the API key. Note that the users of the app are not directly affected by this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://play.google.com/store/apps/details?id=jp.kakao.piccoma - https://apps.apple.com/jp/app/%E3%83%9
r: References: - https://play.google.com/store/apps/details?id=jp.kakao.piccoma - https://apps.apple.com/jp/app/%E3%83%94%E3%83%83%E3%82%B3%E3%83%9E/id1091496983 - https://jvn.jp/en/jp/JVN01073312/
CVE ID: CVE-2024-38481 State: PUBLISHED Published: 2024-08-01T07:23:56.257Z Last Updated: 2024-08-01T18:59:55.991Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:H) Vendors: Dell Products: iDRAC Service Module (iSM) Problem Types: CWE-125 Description: Dell iDRAC Service Module version 5.3.0.0 and prior, contain a Out of bound Read Vulnerability. A privileged local attacker could execute arbitrary code potentially resulting in a denial of service event. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000227444/dsa-2024-086-security-update-for-dell-idrac-service-module-for-memory-corruption-vulnerabilities
CVE ID: CVE-2024-38482 State: PUBLISHED Published: 2024-08-02T04:12:12.391Z Last Updated: 2024-08-02T17:38:31.532Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Dell Products: CloudLink Problem Types: CWE-703 Description: CloudLink, versions 7.1.x and 8.x, contain an Improper check or handling of Exceptional Conditions Vulnerability in Cluster Component. A highly privileged malicious user with remote access could potentially exploit this vulnerability, leading to execute unauthorized actions and retrieve sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/0002274
abase. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000227493/dsa-2024-343-security-update-for-dell-cloudlink-vulnerability
CVE ID: CVE-2024-38483 State: PUBLISHED Published: 2024-08-14T09:24:10.775Z Last Updated: 2024-08-15T14:24:22.170Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:L) Vendors: Dell Products: Dell Client Platform BIOS Problem Types: CWE-20 Description: Dell BIOS contains an Improper Input Validation vulnerability in an externally developed component. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000225776/dsa-2024-260
CVE ID: CVE-2024-38485 State: PUBLISHED Published: 2024-12-09T14:46:33.460Z Last Updated: 2024-12-09T15:04:10.451Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Dell Products: ECS Problem Types: CWE-601 Description: Dell ECS, versions prior to 3.8.0, contain(s) a Host Header Injection Vulnerability. A remote low-privileged attacker could potentially exploit this vulnerability to trigger redirections that leads to sensitive information leakage. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000256185/dsa-2024-331-security-update-for-dell-ecs-host-header-injection-vulnerability
CVE ID: CVE-2024-38486 State: PUBLISHED Published: 2024-09-06T04:06:04.976Z Last Updated: 2024-09-06T13:05:46.448Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Dell Products: SmartFabric OS10 Software Problem Types: CWE-77 Description: Dell SmartFabric OS10 Software, version(s) 10.5.5.4 through 10.5.5.10 and 10.5.6.x , contain(s) an Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/0002
xecution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000228355/dsa-2024-376-security-update-for-dell-networking-os10-vulnerability
CVE ID: CVE-2024-38488 State: PUBLISHED Published: 2024-12-13T14:06:25.845Z Last Updated: 2024-12-13T20:38:43.920Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: Dell Products: RecoverPoint for Virtual Machines Problem Types: CWE-307 Description: Dell RecoverPoint for Virtual Machines 6.0.x contains a vulnerability. An improper Restriction of Excessive Authentication vulnerability where a Network attacker could potentially exploit this vulnerability, leading to a brute force attack or a dictionary attack against the RecoverPoint login form and a complete system compromise. This allows attackers to brute-force the password of valid users in an automated mann
and a complete system compromise. This allows attackers to brute-force the password of valid users in an automated manner. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000259765/dsa-2024-429-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities
CVE ID: CVE-2024-38489 State: PUBLISHED Published: 2024-08-01T07:15:25.948Z Last Updated: 2024-08-01T13:20:25.876Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:L) Vendors: Dell Products: iDRAC Service Module (iSM) Problem Types: CWE-787 Description: Dell iDRAC Service Module version 5.3.0.0 and prior contains Out of bound write Vulnerability. A privileged local attacker could execute arbitrary code potentially resulting in a denial of service (partial) event. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000227444/dsa-2024-086-security-update-for-dell-idrac-service-module-for-memory-corruption-vulnerabilities
CVE ID: CVE-2024-38490 State: PUBLISHED Published: 2024-08-01T07:19:25.493Z Last Updated: 2024-08-01T18:59:51.674Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:H) Vendors: Dell Products: iDRAC Service Module (iSM) Problem Types: CWE-787 Description: Dell iDRAC Service Module version 5.3.0.0 and prior, contain a Out of bound Write Vulnerability. A privileged local attacker could execute arbitrary code potentially resulting in a denial of service event. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000227444/dsa-2024-086-security-update-for-dell-idrac-service-module-for-memory-corruption-vulnerabilities
CVE ID: CVE-2024-38491 State: PUBLISHED Published: 2024-07-15T13:50:52.327Z Last Updated: 2024-11-04T16:36:30.021Z Vendors: Broadcom Products: Symantec Privileged Access Management Description: The vulnerability allows an unauthenticated attacker to read arbitrary information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24678
CVE ID: CVE-2024-38492 State: PUBLISHED Published: 2024-07-15T13:54:38.819Z Last Updated: 2024-08-02T04:12:24.735Z Vendors: Broadcom Products: Symantec Privileged Access Management Description: This vulnerability allows an unauthenticated attacker to achieve remote command execution on the affected PAM system by uploading a specially crafted PAM upgrade file. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24678
CVE ID: CVE-2024-38493 State: PUBLISHED Published: 2024-07-15T14:00:15.105Z Last Updated: 2024-10-27T23:14:03.057Z Vendors: Broadcom Products: Symantec Privileged Access Management Description: A reflected cross-site scripting (XSS) vulnerability exists in the PAM UI web interface. A remote attacker able to convince a PAM user to click on a specially crafted link to the PAM UI web interface could potentially execute arbitrary client-side code in the context of PAM UI. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24678
CVE ID: CVE-2024-38494 State: PUBLISHED Published: 2024-07-15T14:03:53.924Z Last Updated: 2024-08-02T04:12:24.726Z Vendors: Broadcom Products: Symantec Privileged Access Management Description: This vulnerability allows a high-privileged authenticated PAM user to achieve remote command execution on the affected PAM system by sending a specially crafted HTTP request. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24678
CVE ID: CVE-2024-38495 State: PUBLISHED Published: 2024-07-15T14:13:12.364Z Last Updated: 2024-11-04T19:03:14.832Z Vendors: Broadcom Products: Symantec Privileged Access Management Description: A specific authentication strategy allows a malicious attacker to learn ids of all PAM users defined in its database. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24678
CVE ID: CVE-2024-38496 State: PUBLISHED Published: 2024-07-15T14:16:57.213Z Last Updated: 2024-12-03T18:52:06.312Z Vendors: Broadcom Products: Symantec Privileged Access Management Description: The vulnerability allows a malicious low-privileged PAM user to access information about other PAM users and their group memberships. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24678
CVE ID: CVE-2024-38499 State: PUBLISHED Published: 2024-12-17T05:43:00.369Z Last Updated: 2024-12-19T06:03:39.527Z Vendors: Broadcom Products: CA Client Automation (ITCM) Problem Types: CWE-269 Description: CA Client Automation (ITCM) allows non-admin/non-root users to encrypt a string using CAF CLI and SD_ACMD CLI. This would allow the non admin user to access the critical encryption keys which further causes the exploitation of stored credentials. This fix doesn't allow a non-admin/non-root user to execute "caf encrypt"/"sd_acmd encrypt" commands. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.broadcom.com/web/ecx/support-content-n
: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25284
CVE ID: CVE-2024-38501 State: PUBLISHED Published: 2024-08-13T12:33:00.703Z Last Updated: 2024-08-13T13:31:52.009Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Pepperl+Fuchs Products: ICDM-RX/TCP-DB9/RJ45-DIN, ICDM-RX/TCP-ST/RJ45-DIN, ICDM-RX/TCP-4DB9/2RJ45-DIN, ICDM-RX/TCP-DB9/RJ45-PM, ICDM-RX/TCP-2DB9/RJ45-DIN, ICDM-RX/TCP-2ST/RJ45-DIN, ICDM-RX/TCP-4DB9/2RJ45-PM, ICDM-RX/TCP-8DB9/2RJ45-PM, ICDM-RX/TCP-16RJ45/RJ45-RM, ICDM-RX/TCP-16DB9/RJ45-RM, ICDM-RX/TCP-32RJ45/RJ45-RM, ICDM-RX/TCP-DB9/RJ45-PM2, ICDM-RX/TCP-16RJ45/2RJ45-PM, ICDM-RX/PN-DB9/RJ45-DIN, ICDM-RX/PN-ST/RJ45-DIN, ICDM-RX/PN-4DB9/2RJ45-DIN, ICDM-RX/PN-DB9/RJ45-PM, ICDM-RX/PN-2DB9/RJ45-DIN, ICDM