Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-32737 State: PUBLISHED Published: 2024-05-09T14:57:57.579Z Last Updated: 2024-08-02T02:20:35.316Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: CyberPower Products: CyberPower PowerPanel Enterprise Description: A sql injection vulnerability exists in CyberPower PowerPanel Enterprise prior to v2.8.3. An unauthenticated remote attacker can leak sensitive information via the "query_contract_result" function within MCUDBHelper. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2024-14 - https://www.cyberpower.com/global/en/File/GetFileSampleByType?fileId=SU-180
.tenable.com/security/research/tra-2024-14 - https://www.cyberpower.com/global/en/File/GetFileSampleByType?fileId=SU-18070002-07&fileSubType=FileReleaseNote
CVE ID: CVE-2024-32738 State: PUBLISHED Published: 2024-05-09T14:58:13.209Z Last Updated: 2024-08-02T02:20:35.332Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: CyberPower Products: CyberPower PowerPanel Enterprise Description: A sql injection vulnerability exists in CyberPower PowerPanel Enterprise prior to v2.8.3. An unauthenticated remote attacker can leak sensitive information via the "query_ptask_lean" function within MCUDBHelper. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2024-14 - https://www.cyberpower.com/global/en/File/GetFileSampleByType?fileId=SU-18070002
ble.com/security/research/tra-2024-14 - https://www.cyberpower.com/global/en/File/GetFileSampleByType?fileId=SU-18070002-07&fileSubType=FileReleaseNote
CVE ID: CVE-2024-32739 State: PUBLISHED Published: 2024-05-09T14:58:30.263Z Last Updated: 2025-03-28T19:02:37.662Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: CyberPower Products: CyberPower PowerPanel Enterprise Description: A sql injection vulnerability exists in CyberPower PowerPanel Enterprise prior to v2.8.3. An unauthenticated remote attacker can leak sensitive information via the "query_ptask_verbose" function within MCUDBHelper. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2024-14 - https://www.cyberpower.com/global/en/File/GetFileSampleByType?fileId=SU-18070
CVE ID: CVE-2024-32740 State: PUBLISHED Published: 2024-05-14T10:02:47.049Z Last Updated: 2024-08-02T02:20:35.369Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: SIMATIC CN 4100 Problem Types: CWE-798 Description: A vulnerability has been identified in SIMATIC CN 4100 (All versions < V3.0). The affected device contains undocumented users and credentials. An attacker could misuse the credentials to compromise the device locally or over the network. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/html/ssa-273900.html
CVE ID: CVE-2024-32741 State: PUBLISHED Published: 2024-05-14T10:02:48.224Z Last Updated: 2024-08-02T02:20:34.965Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: SIMATIC CN 4100 Problem Types: CWE-259 Description: A vulnerability has been identified in SIMATIC CN 4100 (All versions < V3.0). The affected device contains hard coded password which is used for the privileged system user `root` and for the boot loader `GRUB` by default . An attacker who manages to crack the password hash gains root access to the device. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cert-portal.s
device. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/html/ssa-273900.html
CVE ID: CVE-2024-32742 State: PUBLISHED Published: 2024-05-14T10:02:49.388Z Last Updated: 2024-08-02T02:20:35.285Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: SIMATIC CN 4100 Problem Types: CWE-1326 Description: A vulnerability has been identified in SIMATIC CN 4100 (All versions < V3.0). The affected device contains an unrestricted USB port. An attacker with local access to the device could potentially misuse the port for booting another operating system and gain complete read/write access to the filesystem. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cert-portal.siemens
m. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/html/ssa-273900.html
CVE ID: CVE-2024-32743 State: PUBLISHED Published: 2024-04-17T00:00:00 Last Updated: 2024-08-02T02:20:35.267Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in the Settings section of WonderCMS v3.4.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the SITE LANGUAGE CONFIG parameter under the Security module. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/adiapera/xss_security_wondercms_3.4.3
CVE ID: CVE-2024-32744 State: PUBLISHED Published: 2024-04-17T00:00:00 Last Updated: 2024-08-02T02:20:35.284Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in the Settings section of WonderCMS v3.4.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the PAGE KEYWORDS parameter under the CURRENT PAGE module. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/adiapera/xss_current_page_wondercms_3.4.3
CVE ID: CVE-2024-32745 State: PUBLISHED Published: 2024-04-17T00:00:00 Last Updated: 2024-08-02T02:20:34.682Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in the Settings section of WonderCMS v3.4.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the PAGE DESCRIPTION parameter under the CURRENT PAGE module. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/adiapera/xss_current_page_wondercms_3.4.3
CVE ID: CVE-2024-32746 State: PUBLISHED Published: 2024-04-17T00:00:00 Last Updated: 2024-08-02T02:20:35.266Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in the Settings section of WonderCMS v3.4.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the MENU parameter under the Menu module. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/adiapera/xss_menu_page_wondercms_3.4.3
CVE ID: CVE-2024-32752 State: PUBLISHED Published: 2024-06-06T20:49:53.476Z Last Updated: 2025-04-24T20:05:35.350Z Vendors: Johnson Controls Products: iSTAR Configuration Utility (ICU), iSTAR Pro, Edge and eX, iSTAR Ultra and Ultra LT Problem Types: CWE-306 Description: The iSTAR door controllers running firmware prior to version 6.6.B, does not support authenticated communications with ICU, which may allow an attacker to gain unauthorized access Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories - https://www.cisa.gov/news-events/ics-advisories/icsa-24-158-04
CVE ID: CVE-2024-32753 State: PUBLISHED Published: 2024-07-11T15:30:39.367Z Last Updated: 2024-08-16T14:50:34.077Z Vendors: Johnson Controls Products: TYCO Illustra Pro4 Fixed cameras, TYCO Illustra Pro4 PTZ cameras, TYCO Illustra Flex4 Fixed & PTZ cameras, TYCO Illustra Pro4 MultiSensor Cameras, TYCO Illustra Flex4 DualSensor Cameras Problem Types: CWE-1395 Description: Under certain circumstances the camera may be susceptible to known vulnerabilities associated with the JQuery versions prior to 3.5.0 third-party component Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories -
- CVE Program Container: References: - https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories - https://www.cisa.gov/news-events/ics-advisories/icsa-24-191-03
CVE ID: CVE-2024-32754 State: PUBLISHED Published: 2024-07-04T10:43:46.161Z Last Updated: 2025-08-27T20:42:54.379Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Johnson Controls Products: Kantech KT1 Door Controller, Rev01, Kantech KT2 Door Controller, Rev01, Kantech KT400 Door Controller, Rev01 Problem Types: CWE-200 Description: Under certain circumstances, when the controller is in factory reset mode waiting for initial setup, it will broadcast its MAC address, serial number, and firmware version. Once configured, the controller will no longer broadcast this information. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References
onger broadcast this information. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories - https://www.cisa.gov/news-events/ics-advisories/icsa-24-184-01
CVE ID: CVE-2024-32755 State: PUBLISHED Published: 2024-07-02T13:38:41.336Z Last Updated: 2024-08-02T02:20:35.243Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Johnson Controls Products: American Dynamics Illustra Essentials Gen 4 Problem Types: CWE-20 Description: Under certain circumstances the web interface will accept characters unrelated to the expected input. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories - https://www.cisa.gov/news-events/ics-advisories/icsa-24-179-04
CVE ID: CVE-2024-32756 State: PUBLISHED Published: 2024-07-02T13:53:18.769Z Last Updated: 2024-08-02T02:20:35.182Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N) Vendors: Johnson Controls Products: American Dynamics Illustra Essentials Gen 4 Problem Types: CWE-257 Description: Under certain circumstances the Linux users credentials may be recovered by an authenticated user. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories - https://www.cisa.gov/news-events/ics-advisories/icsa-24-179-05
CVE ID: CVE-2024-32757 State: PUBLISHED Published: 2024-07-02T14:02:15.247Z Last Updated: 2024-08-02T02:20:35.566Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N) Vendors: Johnson Controls Products: American Dynamics Illustra Essentials Gen 4 Problem Types: CWE-532 Description: Under certain circumstances unnecessary user details are provided within system logs Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories - https://www.cisa.gov/news-events/ics-advisories/icsa-24-179-06
CVE ID: CVE-2024-32758 State: PUBLISHED Published: 2024-08-01T21:50:16.134Z Last Updated: 2024-08-06T20:35:07.083Z Vendors: Johnson Controls Products: exacqVision Problem Types: CWE-326 Description: Under certain circumstances the communication between exacqVision Client and exacqVision Server will use insufficient key length and exchange Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories - https://www.cisa.gov/news-events/ics-advisories/icsa-24-214-01
CVE ID: CVE-2024-32759 State: PUBLISHED Published: 2024-07-10T17:43:01.428Z Last Updated: 2024-08-02T02:20:35.254Z Vendors: Johnson Controls Products: Software House C•CURE 9000 Problem Types: CWE-1391 Description: Under certain circumstances the Software House C●CURE 9000 installer will utilize weak credentials. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories - https://www.cisa.gov/news-events/ics-advisories/icsa-24-191-04
CVE ID: CVE-2024-32760 State: PUBLISHED Published: 2024-05-29T16:02:04.985Z Last Updated: 2025-02-13T17:52:17.693Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: F5 Products: NGINX Open Source, NGINX Plus Problem Types: CWE-787 Description: When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed HTTP/3 encoder instructions can cause NGINX worker processes to terminate or cause or other potential impact. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://my.f5.com/manage/s/article/K000139609 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/me
/manage/s/article/K000139609 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/R7RPLWC35WHEUFCGKNFG62ESNID25TEZ/ - http://www.openwall.com/lists/oss-security/2024/05/30/4 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MLAOKJWDALQZBIV3WKGPJ6T5Z56D3PRD/
CVE ID: CVE-2024-32761 State: PUBLISHED Published: 2024-05-08T15:01:29.122Z Last Updated: 2024-08-02T02:20:35.197Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H) Vendors: F5 Products: BIG-IP Problem Types: CWE-119 Description: Under certain conditions, a potential data leak may occur in the Traffic Management Microkernels (TMMs) of BIG-IP tenants running on VELOS and rSeries platforms. However, this issue cannot be exploited by an attacker because it is not consistently reproducible and is beyond an attacker's control. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE
have reached End of Technical Support (EoTS) are not evaluated Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://my.f5.com/manage/s/article/K000139217
CVE ID: CVE-2024-32762 State: PUBLISHED Published: 2024-09-06T16:27:22.225Z Last Updated: 2024-09-06T17:32:52.859Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:H) Vendors: QNAP Systems Inc. Products: QuLog Center Problem Types: CWE-79 Description: A cross-site scripting (XSS) vulnerability has been reported to affect QuLog Center. If exploited, the vulnerability could allow users to inject malicious code via a network. We have already fixed the vulnerability in the following versions: QuLog Center 1.8.0.872 ( 2024/06/17 ) and later QuLog Center 1.7.0.827 ( 2024/06/17 ) and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/se
827 ( 2024/06/17 ) and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security-advisory/qsa-24-30
CVE ID: CVE-2024-32763 State: PUBLISHED Published: 2024-09-06T16:27:41.126Z Last Updated: 2024-09-06T17:05:19.113Z Vendors: QNAP Systems Inc. Products: QTS, QuTS hero Problem Types: CWE-120, CWE-122 Description: A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to execute code via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.8.2823 build 20240712 and later QuTS hero h5.1.8.2823 build 20240712 and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security-advisory/qsa-2
d later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security-advisory/qsa-24-33
CVE ID: CVE-2024-32764 State: PUBLISHED Published: 2024-04-26T15:00:51.334Z Last Updated: 2024-08-02T02:20:35.321Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L) Vendors: QNAP Systems Inc. Products: myQNAPcloud Link Problem Types: CWE-306, CWE-346, CWE-749 Description: A missing authentication for critical function vulnerability has been reported to affect myQNAPcloud Link. If exploited, the vulnerability could allow users with the privilege level of some functionality via a network. We have already fixed the vulnerability in the following version: myQNAPcloud Link 2.4.51 and later Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: Referen
n: myQNAPcloud Link 2.4.51 and later Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.qnap.com/en/security-advisory/qsa-24-09
CVE ID: CVE-2024-32765 State: PUBLISHED Published: 2024-08-09T17:09:46.468Z Last Updated: 2024-08-09T18:20:43.861Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L) Vendors: QNAP Systems Inc. Products: QTS, QuTS hero Problem Types: CWE-291, CWE-306 Description: A vulnerability has been reported to affect Network & Virtual Switch. If exploited, the vulnerability could allow local authenticated administrators to gain access to and execute certain functions via unspecified vectors. We have already fixed the vulnerability in the following versions: QTS 5.1.8.2823 build 20240712 and later QuTS hero h5.1.8.2823 build 20240712 and later Additional Analyst Notes: - CISA ADP Vu
1.8.2823 build 20240712 and later QuTS hero h5.1.8.2823 build 20240712 and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security-advisory/qsa-24-14
CVE ID: CVE-2024-32766 State: PUBLISHED Published: 2024-04-26T15:00:43.258Z Last Updated: 2024-08-02T02:20:35.334Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: QNAP Systems Inc. Products: QTS, QuTS hero, QuTScloud Problem Types: CWE-77, CWE-78 Description: An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute commands via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.3.2578 build 20231110 and later QTS 4.5.4.2627 build 20231225 and later QuTS hero h5.1.3.2578 build 20231110 and later QuTS hero h4.5.4.262
10 and later QTS 4.5.4.2627 build 20231225 and later QuTS hero h5.1.3.2578 build 20231110 and later QuTS hero h4.5.4.2626 build 20231225 and later QuTScloud c5.1.5.2651 and later Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.qnap.com/en/security-advisory/qsa-24-09
CVE ID: CVE-2024-32767 State: PUBLISHED Published: 2024-11-22T15:34:04.301Z Last Updated: 2024-11-22T16:44:56.514Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N) Vendors: QNAP Systems Inc. Products: Photo Station Problem Types: CWE-79 Description: A cross-site scripting (XSS) vulnerability has been reported to affect Photo Station. If exploited, the vulnerability could allow remote attackers who have gained user access to inject malicious code. We have already fixed the vulnerability in the following version: Photo Station 6.4.3 ( 2024/07/12 ) and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security-advisory/qsa-24-
later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security-advisory/qsa-24-39
CVE ID: CVE-2024-32768 State: PUBLISHED Published: 2024-11-22T15:33:58.050Z Last Updated: 2024-11-22T16:44:56.621Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N) Vendors: QNAP Systems Inc. Products: Photo Station Problem Types: CWE-79 Description: A cross-site scripting (XSS) vulnerability has been reported to affect Photo Station. If exploited, the vulnerability could allow remote attackers who have gained user access to inject malicious code. We have already fixed the vulnerability in the following version: Photo Station 6.4.3 ( 2024/07/12 ) and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security-advisory/qsa-24-
CVE ID: CVE-2024-32769 State: PUBLISHED Published: 2024-11-22T15:33:52.295Z Last Updated: 2024-11-22T16:44:56.748Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N) Vendors: QNAP Systems Inc. Products: Photo Station Problem Types: CWE-79 Description: A cross-site scripting (XSS) vulnerability has been reported to affect Photo Station. If exploited, the vulnerability could allow remote attackers who have gained user access to inject malicious code. We have already fixed the vulnerability in the following version: Photo Station 6.4.3 ( 2024/07/12 ) and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security-advisory/qsa-24-
CVE ID: CVE-2024-32770 State: PUBLISHED Published: 2024-11-22T15:33:46.880Z Last Updated: 2024-11-22T16:44:56.903Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N) Vendors: QNAP Systems Inc. Products: Photo Station Problem Types: CWE-79 Description: A cross-site scripting (XSS) vulnerability has been reported to affect Photo Station. If exploited, the vulnerability could allow remote attackers who have gained user access to inject malicious code. We have already fixed the vulnerability in the following version: Photo Station 6.4.3 ( 2024/07/12 ) and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security-advisory/qsa-24-
CVE ID: CVE-2024-32771 State: PUBLISHED Published: 2024-09-06T16:27:12.908Z Last Updated: 2024-09-06T17:33:45.895Z Severity: LOW (CVSS 2.6 CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:N) Vendors: QNAP Systems Inc. Products: QTS, QuTS hero, QuTScloud Problem Types: CWE-307 Description: An improper restriction of excessive authentication attempts vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow local network authenticated administrators to perform an arbitrary number of authentication attempts via unspecified vectors. QuTScloud is not affected. We have already fixed the vulnerability in the following versions: QTS 5.2.0
ecified vectors. QuTScloud is not affected. We have already fixed the vulnerability in the following versions: QTS 5.2.0.2782 build 20240601 and later QuTS hero h5.2.0.2782 build 20240601 and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security-advisory/qsa-24-28
CVE ID: CVE-2024-32772 State: PUBLISHED Published: 2024-04-24T10:19:29.541Z Last Updated: 2024-08-02T02:20:35.308Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Metagauss Products: ProfileGrid Problem Types: CWE-639 Description: Authorization Bypass Through User-Controlled Key vulnerability in Metagauss ProfileGrid.This issue affects ProfileGrid : from n/a through 5.7.9. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/profilegrid-user-profiles-groups-and-communities/wordpress-profilegrid-plugin-5-7-9-insecure-direct-object-references-idor-vulnerability?_s_id=cve
CVE ID: CVE-2024-32773 State: PUBLISHED Published: 2024-04-24T14:58:17.292Z Last Updated: 2024-08-02T02:20:35.414Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: WP Royal Products: Royal Elementor Kit Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in WP Royal Royal Elementor Kit.This issue affects Royal Elementor Kit: from n/a through 1.0.116. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/royal-elementor-kit/wordpress-royal-elementor-kit-theme-1-0-116-cross-site-request-forgery-csrf-vulnerability?_s_id=cve