Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-7326 State: PUBLISHED Published: 2024-07-31T20:31:06.318Z Last Updated: 2024-08-06T18:02:24.388Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: IObit Products: DualSafe Password Manager Problem Types: CWE-427 Description: A vulnerability classified as critical has been found in IObit DualSafe Password Manager 1.4.0.3. This affects an unknown part in the library RTL120.BPL of the component BPL Handler. The manipulation leads to uncontrolled search path. It is possible to launch the attack on the local host. The identifier VDB-273249 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respo
-273249 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.273249 - https://vuldb.com/?ctiid.273249 - https://vuldb.com/?submit.378150 - https://lab52.io/blog/dll-side-loading-through-iobit-against-colombia/
CVE ID: CVE-2024-7327 State: PUBLISHED Published: 2024-07-31T22:00:19.625Z Last Updated: 2024-08-01T14:12:10.281Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Xinhu Products: RockOA Problem Types: CWE-89 Description: A vulnerability classified as critical was found in Xinhu RockOA 2.6.2. This vulnerability affects the function dataAction of the file /webmain/task/openapi/openmodhetongAction.php. The manipulation of the argument nickName leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-273250 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure
VDB-273250 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.273250 - https://vuldb.com/?ctiid.273250 - https://vuldb.com/?submit.378320 - https://wiki.shikangsi.com/post/share/789dad54-851b-4ec6-a1f6-11271e30db71
CVE ID: CVE-2024-7328 State: PUBLISHED Published: 2024-07-31T22:31:09.516Z Last Updated: 2024-08-01T19:23:17.859Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: n/a Products: YouDianCMS Problem Types: CWE-200 Description: A vulnerability, which was classified as problematic, has been found in YouDianCMS 7. This issue affects some unknown processing of the file /t.php?action=phpinfo. The manipulation leads to information disclosure. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-273251. NOTE: The vendor was contacted early about this disclosure but did
iated identifier of this vulnerability is VDB-273251. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.273251 - https://vuldb.com/?ctiid.273251 - https://vuldb.com/?submit.378323 - https://wiki.shikangsi.com/post/share/ce9ce9b8-dec1-4d85-a955-8e5876cc270f
CVE ID: CVE-2024-7329 State: PUBLISHED Published: 2024-07-31T23:00:09.341Z Last Updated: 2024-08-06T18:30:12.671Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: n/a Products: YouDianCMS Problem Types: CWE-434 Description: A vulnerability, which was classified as critical, was found in YouDianCMS 7. Affected is an unknown function of the file /Public/ckeditor/plugins/multiimage/dialogs/image_upload.php. The manipulation of the argument files leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-273252. NOTE: The vendor was contacted early about this dis
and may be used. The identifier of this vulnerability is VDB-273252. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.273252 - https://vuldb.com/?ctiid.273252 - https://vuldb.com/?submit.378324 - https://wiki.shikangsi.com/post/share/30c24c77-42e6-4a0c-b60b-e02d09dc325b
CVE ID: CVE-2024-7330 State: PUBLISHED Published: 2024-07-31T23:31:06.748Z Last Updated: 2024-08-02T15:49:53.485Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: n/a Products: YouDianCMS Problem Types: CWE-918 Description: A vulnerability has been found in YouDianCMS 7 and classified as critical. Affected by this vulnerability is the function curl_exec of the file /App/Core/Extend/Function/ydLib.php. The manipulation of the argument url leads to server-side request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-273253 was assigned to this vulnerability. NOTE: The vendor was contacted early about this
y be used. The identifier VDB-273253 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.273253 - https://vuldb.com/?ctiid.273253 - https://vuldb.com/?submit.378325 - https://wiki.shikangsi.com/post/share/c065b84c-f2ab-4679-9336-de7fb1ebba1f
CVE ID: CVE-2024-7331 State: PUBLISHED Published: 2024-08-01T00:00:06.525Z Last Updated: 2024-08-01T14:18:14.922Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: TOTOLINK Products: A3300R Problem Types: CWE-120 Description: A vulnerability was found in TOTOLINK A3300R 17.0.0cu.557_B20221024 and classified as critical. Affected by this issue is the function UploadCustomModule of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument File leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-273254 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this discl
used. VDB-273254 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.273254 - https://vuldb.com/?ctiid.273254 - https://vuldb.com/?submit.378351 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/TOTOLINK/A3300R/UploadCustomModule.md
CVE ID: CVE-2024-7332 State: PUBLISHED Published: 2024-08-01T00:31:04.452Z Last Updated: 2024-08-06T19:35:53.846Z Severity: N/A (CVSS 10 AV:N/AC:L/Au:N/C:C/I:C/A:C) Vendors: TOTOLINK Products: CP450 Problem Types: CWE-259 Description: A vulnerability was found in TOTOLINK CP450 4.1.0cu.747_B20191224. It has been classified as critical. This affects an unknown part of the file /web_cste/cgi-bin/product.ini of the component Telnet Service. The manipulation leads to use of hard-coded password. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-273255. NOTE: The vendor was contacted
e public and may be used. The associated identifier of this vulnerability is VDB-273255. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.273255 - https://vuldb.com/?ctiid.273255 - https://vuldb.com/?submit.378357 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/TOTOLINK/CP450/product.md
CVE ID: CVE-2024-7333 State: PUBLISHED Published: 2024-08-01T01:00:07.454Z Last Updated: 2024-08-06T20:42:41.669Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: TOTOLINK Products: N350RT Problem Types: CWE-120 Description: A vulnerability was found in TOTOLINK N350RT 9.3.5u.6139_B20201216. It has been declared as critical. This vulnerability affects the function setParentalRules of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument week/sTime/eTime leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-273256. NOTE: The vendor was contacted early about t
public and may be used. The identifier of this vulnerability is VDB-273256. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.273256 - https://vuldb.com/?ctiid.273256 - https://vuldb.com/?submit.379281 - https://github.com/135a/IoT-vulnerable/blob/main/TOTOLINK/N350RT/setParentalRules.md
CVE ID: CVE-2024-7334 State: PUBLISHED Published: 2024-08-01T01:31:04.816Z Last Updated: 2024-08-02T15:41:49.498Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: TOTOLINK Products: EX1200L Problem Types: CWE-120 Description: A vulnerability was found in TOTOLINK EX1200L 9.3.5u.6146_B20201023. It has been rated as critical. This issue affects the function UploadCustomModule of the file /cgi-bin/cstecgi.cgi. The manipulation leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-273257 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not res
DB-273257 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.273257 - https://vuldb.com/?ctiid.273257 - https://vuldb.com/?submit.379286 - https://github.com/ruan-uer/create/blob/main/IoT-vulnerable/TOTOLINK/EX1200/UploadCustomModule.md
CVE ID: CVE-2024-7335 State: PUBLISHED Published: 2024-08-01T02:00:06.560Z Last Updated: 2024-08-06T19:39:28.167Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: TOTOLINK Products: EX200 Problem Types: CWE-120 Description: A vulnerability classified as critical has been found in TOTOLINK EX200 4.0.3c.7646_B20201211. Affected is the function getSaveConfig of the file /cgi-bin/cstecgi.cgi?action=save&setting. The manipulation of the argument http_host leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-273258 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early abo
c and may be used. VDB-273258 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.273258 - https://vuldb.com/?ctiid.273258 - https://vuldb.com/?submit.379313 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/TOTOLINK/EX200/getSaveConfig.md
CVE ID: CVE-2024-7336 State: PUBLISHED Published: 2024-08-01T02:31:04.790Z Last Updated: 2024-08-01T13:30:01.939Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: TOTOLINK Products: EX200 Problem Types: CWE-120 Description: A vulnerability classified as critical was found in TOTOLINK EX200 4.0.3c.7646_B20201211. Affected by this vulnerability is the function loginauth of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument http_host leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-273259. NOTE: The vendor was contacted early about this disclo
d. The associated identifier of this vulnerability is VDB-273259. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.273259 - https://vuldb.com/?ctiid.273259 - https://vuldb.com/?submit.379314 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/TOTOLINK/EX200/loginauth.md
CVE ID: CVE-2024-7337 State: PUBLISHED Published: 2024-08-01T03:00:06.098Z Last Updated: 2024-08-01T20:39:06.187Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: TOTOLINK Products: EX1200L Problem Types: CWE-120 Description: A vulnerability, which was classified as critical, has been found in TOTOLINK EX1200L 9.3.5u.6146_B20201023. Affected by this issue is the function loginauth of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument http_host leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-273260. NOTE: The vendor was contacted early about this disc
nd may be used. The identifier of this vulnerability is VDB-273260. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.273260 - https://vuldb.com/?ctiid.273260 - https://vuldb.com/?submit.379315 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/TOTOLINK/EX1200/loginauth.md
CVE ID: CVE-2024-7338 State: PUBLISHED Published: 2024-08-01T03:31:04.032Z Last Updated: 2024-08-06T20:41:31.965Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: TOTOLINK Products: EX1200L Problem Types: CWE-120 Description: A vulnerability, which was classified as critical, was found in TOTOLINK EX1200L 9.3.5u.6146_B20201023. This affects the function setParentalRules of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument week/sTime/eTime leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-273261 was assigned to this vulnerability. NOTE: The vendor was contacted earl
ublic and may be used. The identifier VDB-273261 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.273261 - https://vuldb.com/?ctiid.273261 - https://vuldb.com/?submit.379316 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/TOTOLINK/EX1200/setParentalRules.md
CVE ID: CVE-2024-7339 State: PUBLISHED Published: 2024-08-01T04:00:10.091Z Last Updated: 2024-08-07T14:31:11.792Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: TVT Products: DVR TD-2104TS-CL, DVR TD-2108TS-HP, Provision-ISR DVR SH-4050A5-5L(MM), AVISION DVR AV108T Problem Types: CWE-200 Description: A vulnerability has been found in TVT DVR TD-2104TS-CL, DVR TD-2108TS-HP, Provision-ISR DVR SH-4050A5-5L(MM) and AVISION DVR AV108T and classified as problematic. This vulnerability affects unknown code of the file /queryDevInfo. The manipulation leads to information disclosure. The attack can be initiated remotely. The exploit has been disclosed to the public
ion leads to information disclosure. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-273262 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.273262 - https://vuldb.com/?ctiid.273262 - https://vuldb.com/?submit.379373 - https://netsecfish.notion.site/Sensitive-Device-Information-Disclosure-in-TVT-DVR-fad1cce703d946969be5130bf3aaac0d?pvs=4
CVE ID: CVE-2024-7340 State: PUBLISHED Published: 2024-07-31T15:00:04.218Z Last Updated: 2024-11-25T12:44:07.639Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Problem Types: CWE-22 Description: The Weave server API allows remote users to fetch files from a specific directory, but due to a lack of input validation, it is possible to traverse and leak arbitrary files remotely. In various common scenarios, this allows a low-privileged user to assume the role of the server admin. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://research.jfrog.com/vulnerabilities/wandb-weave-server-remote-arbitrary-file-leak-jfsa-2024-001039248/ - https://github.c
research.jfrog.com/vulnerabilities/wandb-weave-server-remote-arbitrary-file-leak-jfsa-2024-001039248/ - https://github.com/wandb/weave/pull/1657
CVE ID: CVE-2024-7341 State: PUBLISHED Published: 2024-09-09T18:51:13.537Z Last Updated: 2025-11-13T17:36:55.435Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Red Hat Products: Red Hat Build of Keycloak, Red Hat build of Keycloak 22, Red Hat build of Keycloak 24, Red Hat Single Sign-On 7, Red Hat Single Sign-On 7.6 for RHEL 7, Red Hat Single Sign-On 7.6 for RHEL 8, Red Hat Single Sign-On 7.6 for RHEL 9, RHEL-8 based Middleware Containers, Red Hat JBoss Enterprise Application Platform 8 Problem Types: CWE-384 Description: A session fixation issue was discovered in the SAML adapters provided by Keycloak. The session ID and JSESSIONID cookie are not changed at
issue was discovered in the SAML adapters provided by Keycloak. The session ID and JSESSIONID cookie are not changed at login time, even when the turnOffChangeSessionIdOnLogin option is configured. This flaw allows an attacker who hijacks the current session before authentication to trigger session fixation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2024:6493 - https://access.redhat.com/errata/RHSA-2024:6494 - https://access.redhat.com/errata/RHSA-2024:6495 - https://access.redhat.com/errata/RHSA-2024:6497 - https://access.redhat.com/errata/RHSA-2024:6499 - https://access.redhat.com/errata/RHSA-2024:6500 - https://access.redhat.co
s://access.redhat.com/errata/RHSA-2024:6499 - https://access.redhat.com/errata/RHSA-2024:6500 - https://access.redhat.com/errata/RHSA-2024:6501 - https://access.redhat.com/errata/RHSA-2024:6502 - https://access.redhat.com/errata/RHSA-2024:6503 - https://access.redhat.com/security/cve/CVE-2024-7341 - https://bugzilla.redhat.com/show_bug.cgi?id=2302064
CVE ID: CVE-2024-7342 State: PUBLISHED Published: 2024-08-01T04:31:04.276Z Last Updated: 2024-08-01T13:28:02.073Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:N/A:P) Vendors: Baidu Products: UEditor Problem Types: CWE-434 Description: A vulnerability was found in Baidu UEditor 1.4.3.3. It has been classified as problematic. This affects an unknown part of the file /ueditor/php/controller.php?action=uploadfile&encode=utf-8. The manipulation of the argument upfile leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-273273 was assigned to this vulnerability. NOTE: The vendor was contacted ea
public and may be used. The identifier VDB-273273 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.273273 - https://vuldb.com/?ctiid.273273 - https://vuldb.com/?submit.380092 - https://github.com/Hebing123/cve/issues/62
CVE ID: CVE-2024-7343 State: PUBLISHED Published: 2024-08-01T05:00:07.311Z Last Updated: 2024-08-01T19:06:52.844Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: Baidu Products: UEditor Problem Types: CWE-79 Description: A vulnerability was found in Baidu UEditor 1.4.2. It has been declared as problematic. This vulnerability affects unknown code of the file /ueditor142/php/controller.php?action=catchimage. The manipulation of the argument source[] leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-273274 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about th
may be used. VDB-273274 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.273274 - https://vuldb.com/?ctiid.273274 - https://vuldb.com/?submit.380151 - https://github.com/Hebing123/cve/issues/63
CVE ID: CVE-2024-7344 State: PUBLISHED Published: 2025-01-14T13:29:56.915Z Last Updated: 2025-09-15T15:36:17.748Z Vendors: Radix, Greenware Technologies, Howyar Technologies, SANFONG, CES Taiwan, SignalComputer Products: SmartRecovery, GreenGuard, SysReturn (32-bit and 64-bit), SANFONG EZ-Back System, CES NeoImpact, HDD King Problem Types: CWE-426: Untrusted Search Path, CWE-347: Lack/Improper Verification of Cryptographic Signature Description: Howyar UEFI Application "Reloader" (32-bit and 64-bit) is vulnerable to execution of unsigned software in a hardcoded path. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://uefi.org/revocationlistfile
onal Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://uefi.org/revocationlistfile - https://uefi.org/specs/UEFI/2.10/32_Secure_Boot_and_Driver_Signing.html - https://uefi.org/specs/UEFI/2.10/03_Boot_Manager.html - https://www.eset.com/blog/enterprise/preparing-for-uefi-bootkits-eset-discovery-shows-the-importance-of-cyber-intelligence/
CVE ID: CVE-2024-7345 State: PUBLISHED Published: 2024-09-03T14:50:15.520Z Last Updated: 2024-09-03T15:08:13.876Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Progress Products: OpenEdge Problem Types: CWE-94 Description: Local ABL Client bypass of the required PASOE security checks may allow an attacker to commit unauthorized code injection into Multi-Session Agents on supported OpenEdge LTS platforms up to OpenEdge LTS 11.7.18 and LTS 12.2.13 on all supported release platforms Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://community.progress.com/s/article/Direct-local-client-connections-to-MS-Agents-can-bypass-authentication
CVE ID: CVE-2024-7346 State: PUBLISHED Published: 2024-09-03T14:51:03.551Z Last Updated: 2024-09-03T15:06:04.578Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: Progress Products: OpenEdge Problem Types: CWE-297 Description: Host name validation for TLS certificates is bypassed when the installed OpenEdge default certificates are used to perform the TLS handshake for a networked connection. This has been corrected so that default certificates are no longer capable of overriding host name validation and will need to be replaced where full TLS certificate validation is needed for network security. The existing certificates should be replaced with CA-signed cert
certificate validation is needed for network security. The existing certificates should be replaced with CA-signed certificates from a recognized certificate authority that contain the necessary information to support host name validation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://community.progress.com/s/article/Client-connections-using-default-TLS-certificates-from-OpenEdge-may-bypass-TLS-host-name-validation
CVE ID: CVE-2024-7347 State: PUBLISHED Published: 2024-08-14T14:32:33.913Z Last Updated: 2025-11-03T20:56:24.679Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: F5 Products: NGINX Open Source, NGINX Plus Problem Types: CWE-126 Description: NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_mp4_module, which might allow an attacker to over-read NGINX worker memory resulting in its termination, using a specially crafted mp4 file. The issue only affects NGINX if it is built with the ngx_http_mp4_module and the mp4 directive is used in the configuration file. Additionally, the attack is possible only if an attacker can trigger the processing
is used in the configuration file. Additionally, the attack is possible only if an attacker can trigger the processing of a specially crafted mp4 file with the ngx_http_mp4_module. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://my.f5.com/manage/s/article/K000140529