Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-22379 State: PUBLISHED Published: 2024-05-16T20:47:11.663Z Last Updated: 2024-08-21T15:10:41.871Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) Inspector software Problem Types: escalation of privilege, CWE-427 Description: Uncontrolled search path in some Intel(R) Inspector software before version 2024.0 may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01043.html
CVE ID: CVE-2024-22380 State: PUBLISHED Published: 2024-01-24T01:32:47.520Z Last Updated: 2025-06-05T16:09:34.231Z Vendors: Ministry of Agriculture, Forestry and Fisheries Products: Electronic Delivery Check System (Ministry of Agriculture, Forestry and Fisheries The Agriculture and Rural Development Project Version) March, Heisei 31 era edition Problem Types: XML external entities (XXE) Description: Electronic Delivery Check System (Ministry of Agriculture, Forestry and Fisheries The Agriculture and Rural Development Project Version) March, Heisei 31 era edition Ver.14.0.001.002 and earlier improperly restricts XML external entity references (XXE). By processing a specially crafted XML file
01.002 and earlier improperly restricts XML external entity references (XXE). By processing a specially crafted XML file, arbitrary files on the system may be read by an attacker. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.maff.go.jp/j/nousin/seko/nouhin_youryou/densi.html - https://jvn.jp/en/jp/JVN01434915/
CVE ID: CVE-2024-22382 State: PUBLISHED Published: 2024-05-16T20:46:58.276Z Last Updated: 2024-08-20T15:03:50.852Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: n/a Products: PprRequestLog module in UEFI firmware for some Intel(R) Server D50DNP Family products Problem Types: escalation of privilege, CWE-20 Description: Improper input validation in PprRequestLog module in UEFI firmware for some Intel(R) Server D50DNP Family products may allow a privileged user to enable escalation of privilege via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.intel.com/content/www/us/en/security-center/advi
SA ADP Vulnrichment: - CVE Program Container: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01080.html
CVE ID: CVE-2024-22383 State: PUBLISHED Published: 2024-03-05T03:12:29.581Z Last Updated: 2024-08-01T22:43:34.539Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Gallagher Products: Controller 7000 Problem Types: CWE-772 Description: Missing release of resource after effective lifetime (CWE-772) in the Controller 7000 resulted in HBUS connected T-Series readers to not automatically recover after coming under attack over the RS-485 interface, resulting in a persistent denial of service. This issue affects: All variants of the Gallagher Controller 7000 9.00 prior to vCR9.00.231204b (distributed in 9.00.1507(MR1)), 8.90 prior to vCR8.90.240209b (distributed in
roller 7000 9.00 prior to vCR9.00.231204b (distributed in 9.00.1507(MR1)), 8.90 prior to vCR8.90.240209b (distributed in 8.90.1751 (MR3)), 8.80 prior to vCR8.80.240209a (distributed in 8.80.1526 (MR4)), 8.70 prior to vCR8.70.240209a (distributed in 8.70.2526 (MR6)). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2024-22383
CVE ID: CVE-2024-22384 State: PUBLISHED Published: 2024-05-16T20:47:37.779Z Last Updated: 2024-08-01T22:43:34.472Z Severity: LOW (CVSS 2.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N) Vendors: n/a Products: Intel(R) Trace Analyzer and Collector software Problem Types: information disclosure, CWE-125 Description: Out-of-bounds read for some Intel(R) Trace Analyzer and Collector software before version 2022.0.0 published Nov 2023 may allow an authenticated user to potentially enable information disclosure via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00983.ht
CVE Program Container: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00983.html
CVE ID: CVE-2024-22385 State: PUBLISHED Published: 2024-06-25T01:34:24.077Z Last Updated: 2024-08-01T22:43:34.581Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: Hitachi Products: Hitachi Storage Provider for VMware vCenter Problem Types: CWE-276 Description: Incorrect Default Permissions vulnerability in Hitachi Storage Provider for VMware vCenter allows local users to read and write specific files.This issue affects Hitachi Storage Provider for VMware vCenter: from 3.1.0 before 3.7.4. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2024-12
CVE Program Container: References: - https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2024-129/index.html
CVE ID: CVE-2024-22386 State: PUBLISHED Published: 2024-02-05T07:21:20.819Z Last Updated: 2024-08-01T22:43:34.688Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:N/A:H) Vendors: Linux Products: Linux kernel Problem Types: CWE-362 Description: A race condition was found in the Linux kernel's drm/exynos device driver in exynos_drm_crtc_atomic_disable() function. This can result in a null pointer dereference issue, possibly leading to a kernel panic or denial of service issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.openanolis.cn/show_bug.cgi?id=8147
CVE ID: CVE-2024-22387 State: PUBLISHED Published: 2024-07-11T02:38:52.029Z Last Updated: 2024-08-01T22:43:34.802Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H) Vendors: Gallagher Products: Controller 6000 and Controller 7000 Problem Types: CWE-642 Description: External Control of Critical State Data (CWE-642) in the Controller 6000 and Controller 7000 diagnostic web interface allows an authenticated user to modify device I/O connections leading to unexpected behavior that in some circumstances could compromise site physical security controls. Gallagher recommend the diagnostic web page is not enabled (default is off) unless advised by Gallagher Technical support.
lagher recommend the diagnostic web page is not enabled (default is off) unless advised by Gallagher Technical support. This interface is intended only for diagnostic purposes. This issue affects: Gallagher Controller 6000 and 7000 9.10 prior to vCR9.10.240520a (distributed in 9.10.1268(MR1)), 9.00 prior to vCR9.00.240521a (distributed in 9.00.1990(MR3)), 8.90 prior to vCR8.90.240520a (distributed in 8.90.1947 (MR4)), 8.80 prior to vCR8.80.240520a (distributed in 8.80.1726 (MR5)), 8.70 prior to vCR8.70.240520a (distributed in 8.70.2824 (MR7)), all versions of 8.60 and prior. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://security.gallagher.c
. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://security.gallagher.com/Security-Advisories/CVE-2024-22387
CVE ID: CVE-2024-22388 State: PUBLISHED Published: 2024-02-06T23:06:07.942Z Last Updated: 2025-05-07T20:06:09.019Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: HID Global Products: iCLASS SE CP1000 Encoder, iCLASS SE Readers, iCLASS SE Reader Modules, iCLASS SE Processors, OMNIKEY 5427CK Readers, OMNIKEY 5127CK Readers, OMNIKEY 5023 Readers, OMNIKEY 5027 Readers Problem Types: CWE-1188 Description: Certain configuration available in the communication channel for encoders could expose sensitive data when reader configuration cards are programmed. This data could include credential and device administration keys. Additional Analyst Notes: - CVE Program Cont
grammed. This data could include credential and device administration keys. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-037-01 - https://support.hidglobal.com/
CVE ID: CVE-2024-22389 State: PUBLISHED Published: 2024-02-14T16:30:19.797Z Last Updated: 2024-08-16T18:11:12.661Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: F5 Products: BIG-IP Problem Types: CWE-613 Description: When BIG-IP is deployed in high availability (HA) and an iControl REST API token is updated, the change does not sync to the peer device. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://my.f5.com/manage/s/article/K32544615
CVE ID: CVE-2024-22390 State: PUBLISHED Published: 2024-05-16T20:47:10.231Z Last Updated: 2024-08-01T22:43:34.572Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: n/a Products: Intel(R) FPGA products Problem Types: denial of service, CWE-20 Description: Improper input validation in firmware for some Intel(R) FPGA products before version 2.9.1 may allow denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01050.html
CVE ID: CVE-2024-22391 State: PUBLISHED Published: 2024-04-25T14:33:07.730Z Last Updated: 2025-11-04T17:14:18.583Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H) Vendors: Grassroot DICOM Products: Grassroot DICOM Problem Types: CWE-119 Description: A heap-based buffer overflow vulnerability exists in the LookupTable::SetLUT functionality of Mathieu Malaterre Grassroot DICOM 3.0.23. A specially crafted malformed file can lead to memory corruption. An attacker can provide a malicious file to trigger this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2024-
ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2024-1924 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N5HXUKUJ7SG3TK456SGUWVZ4Z5D7JKOL/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WJA7QWWZWMY4AQFR35EA7S3CFVUTOQYG/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BZJ4IG7EXMSMPHTK5ZFASCW6MHSOVZOE/
CVE ID: CVE-2024-22393 State: PUBLISHED Published: 2024-02-22T09:51:43.432Z Last Updated: 2025-04-22T16:20:44.318Z Vendors: Apache Software Foundation Products: Apache Answer Problem Types: CWE-434 Description: Unrestricted Upload of File with Dangerous Type vulnerability in Apache Answer.This issue affects Apache Answer: through 1.2.1. Pixel Flood Attack by uploading large pixel files will cause server out of memory. A logged-in user can cause such an attack by uploading an image when posting content. Users are recommended to upgrade to version [1.2.5], which fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lists.apache.org/t
ue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lists.apache.org/thread/f58l6dr4r74hl6o71gn47kmn44vw12cv - http://www.openwall.com/lists/oss-security/2024/02/22/1
CVE ID: CVE-2024-22394 State: PUBLISHED Published: 2024-02-08T01:14:33.634Z Last Updated: 2024-08-22T18:49:34.217Z Vendors: SonicWall Products: SonicOS Problem Types: CWE-287 Description: An improper authentication vulnerability has been identified in SonicWall SonicOS SSL-VPN feature, which in specific conditions could allow a remote attacker to bypass authentication. This issue affects only firmware version SonicOS 7.1.1-7040. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0003
CVE ID: CVE-2024-22395 State: PUBLISHED Published: 2024-02-23T23:37:06.715Z Last Updated: 2024-08-28T20:22:52.086Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: SonicWall Products: SMA100 Problem Types: CWE-287 Description: Improper access control vulnerability has been identified in the SMA100 SSL-VPN virtual office portal, which in specific conditions could potentially enable a remote authenticated attacker to associate another user's MFA mobile application. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0001
CVE ID: CVE-2024-22396 State: PUBLISHED Published: 2024-03-14T03:15:55.008Z Last Updated: 2024-08-01T22:43:34.943Z Vendors: SonicWall Products: SonicOS Problem Types: CWE-190 Description: An Integer-based buffer overflow vulnerability in the SonicOS via IPSec allows a remote attacker in specific conditions to cause Denial of Service (DoS) and potentially execute arbitrary code by sending a specially crafted IKEv2 payload. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0004
CVE ID: CVE-2024-22397 State: PUBLISHED Published: 2024-03-14T03:23:52.971Z Last Updated: 2025-03-27T17:01:13.903Z Vendors: SonicWall Products: SonicOS Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in the SonicOS SSLVPN portal allows a remote authenticated attacker as a firewall 'admin' user to store and execute arbitrary JavaScript code. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0005
CVE ID: CVE-2024-22398 State: PUBLISHED Published: 2024-03-14T03:29:03.884Z Last Updated: 2024-08-08T21:19:19.995Z Vendors: SonicWall Products: Email Security Problem Types: CWE-22 Description: An improper Limitation of a Pathname to a Restricted Directory (Path Traversal) vulnerability in SonicWall Email Security Appliance could allow a remote attacker with administrative privileges to conduct a directory traversal attack and delete arbitrary files from the appliance file system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0006
CVE ID: CVE-2024-22399 State: PUBLISHED Published: 2024-09-16T11:42:05.469Z Last Updated: 2024-09-16T18:06:33.948Z Vendors: Apache Software Foundation Products: Apache Seata Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in Apache Seata. When developers disable authentication on the Seata-Server and do not use the Seata client SDK dependencies, they may construct uncontrolled serialized malicious requests by directly sending bytecode based on the Seata private protocol. This issue affects Apache Seata: 2.0.0, from 1.0.0 through 1.8.0. Users are recommended to upgrade to version 2.1.0/1.8.1, which fixes the issue. Additional Analyst Notes: - CVE Program Co
ers are recommended to upgrade to version 2.1.0/1.8.1, which fixes the issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/91nzzlxyj4nmks85gbzwkkjtbmnmlkc4
CVE ID: CVE-2024-22400 State: PUBLISHED Published: 2024-01-18T19:21:06.618Z Last Updated: 2025-06-17T21:19:22.050Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: nextcloud Products: security-advisories Problem Types: CWE-601 Description: Nextcloud User Saml is an app for authenticating Nextcloud users using SAML. In affected versions users can be given a link to the Nextcloud server and end up on a uncontrolled thirdparty server. It is recommended that the User Saml app is upgraded to version 5.1.5, 5.2.5, or 6.0.1. There are no known workarounds for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://g
unds for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-622q-xhfr-xmv7 - https://github.com/nextcloud/user_saml/pull/788 - https://github.com/nextcloud/user_saml/commit/b184304a476deeba36e92b70562d5de7c2f85f8a - https://hackerone.com/reports/2263044
CVE ID: CVE-2024-22401 State: PUBLISHED Published: 2024-01-18T20:23:52.765Z Last Updated: 2024-10-21T11:42:04.987Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N) Vendors: nextcloud Products: security-advisories Problem Types: CWE-281 Description: Nextcloud guests app is a utility to create guest users which can only see files shared with them. In affected versions users could change the allowed list of apps, allowing them to use apps that were not intended to be used. It is recommended that the Guests app is upgraded to 2.4.1, 2.5.1 or 3.0.1. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrich
are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-wr87-hx3w-29hh - https://github.com/nextcloud/guests/pull/1082 - https://hackerone.com/reports/2250398
CVE ID: CVE-2024-22402 State: PUBLISHED Published: 2024-01-18T20:23:54.714Z Last Updated: 2025-06-09T18:46:12.916Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: nextcloud Products: security-advisories Problem Types: CWE-281 Description: Nextcloud guests app is a utility to create guest users which can only see files shared with them. In affected versions users were able to load the first page of apps they were actually not allowed to access. Depending on the selection of apps installed this may present a permissions bypass. It is recommended that the Guests app is upgraded to 2.4.1, 2.5.1 or 3.0.1. There are no known workarounds for this vulnerability. Add
ded that the Guests app is upgraded to 2.4.1, 2.5.1 or 3.0.1. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-v3qw-7vgv-2fxj - https://github.com/nextcloud/guests/pull/1082 - https://hackerone.com/reports/2251074
CVE ID: CVE-2024-22403 State: PUBLISHED Published: 2024-01-18T20:03:30.623Z Last Updated: 2025-06-17T21:19:22.193Z Severity: LOW (CVSS 3 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:N/A:N) Vendors: nextcloud Products: security-advisories Problem Types: CWE-613 Description: Nextcloud server is a self hosted personal cloud system. In affected versions OAuth codes did not expire. When an attacker would get access to an authorization code they could authenticate at any time using the code. As of version 28.0.0 OAuth codes are invalidated after 10 minutes and will no longer be authenticated. To exploit this vulnerability an attacker would need to intercept an OAuth code from a user session. It is recom
icated. To exploit this vulnerability an attacker would need to intercept an OAuth code from a user session. It is recommended that the Nextcloud Server is upgraded to 28.0.0. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-wppc-f5g8-vx36 - https://github.com/nextcloud/server/pull/40766 - https://hackerone.com/reports/1784162 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S6PN4GVJ5TZUC6WSG4X3ZA3AMPBEKNAX/
CVE ID: CVE-2024-22404 State: PUBLISHED Published: 2024-01-18T20:14:27.914Z Last Updated: 2025-06-02T15:03:33.283Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N) Vendors: nextcloud Products: security-advisories Problem Types: CWE-281 Description: Nextcloud files Zip app is a tool to create zip archives from one or multiple files from within Nextcloud. In affected versions users can download "view-only" files by zipping the complete folder. It is recommended that the Files ZIP app is upgraded to 1.2.1, 1.4.1, or 1.5.0. Users unable to upgrade should disable the file zip app. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - htt
disable the file zip app. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-vhj3-mch4-67fq - https://github.com/nextcloud/files_zip/commit/43204539d517a13e945b90652718e2a213f46820 - https://hackerone.com/reports/2247457
CVE ID: CVE-2024-22405 State: PUBLISHED Published: 2024-04-30T10:04:24.056Z Last Updated: 2024-08-01T22:43:34.924Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) Vendors: MacPaw Products: XADMaster Problem Types: CWE-281 Description: XADMaster is an objective-C library for archive and file unarchiving and extraction. When extracting a specially crafted zip archive XADMaster may not apply quarantine attribute correctly. Such behaviour may circumvent Gatekeeper checks on the system. Only macOS installations are affected. This issue was fixed in XADMaster 1.10.8. It is recommended to upgrade to the latest version. There are no known workarounds for this issue. Addition
ster 1.10.8. It is recommended to upgrade to the latest version. There are no known workarounds for this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/MacPaw/XADMaster/security/advisories/GHSA-xg3c-r7w5-7xw2 - https://github.com/MacPaw/XADMaster/commit/b75c05bc3bca9e183ecd3c512e270ce93006da3c
CVE ID: CVE-2024-22406 State: PUBLISHED Published: 2024-01-16T22:30:04.324Z Last Updated: 2025-06-02T15:06:58.811Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L) Vendors: shopware Products: shopware Problem Types: CWE-89 Description: Shopware is an open headless commerce platform. The Shopware application API contains a search functionality which enables users to search through information stored within their Shopware instance. The searches performed by this function can be aggregated using the parameters in the “aggregations” object. The ‘name’ field in this “aggregations” object is vulnerable SQL-injection and can be exploited using time-based SQL-queries. This
field in this “aggregations” object is vulnerable SQL-injection and can be exploited using time-based SQL-queries. This issue has been addressed and users are advised to update to Shopware 6.5.7.4. For older versions of 6.1, 6.2, 6.3 and 6.4 corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/shopware/shopware/security/advisories/GHSA-qmp9-2xwj-m6m9
CVE ID: CVE-2024-22407 State: PUBLISHED Published: 2024-01-16T22:29:06.955Z Last Updated: 2024-11-13T19:39:35.421Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N) Vendors: shopware Products: shopware Problem Types: CWE-284 Description: Shopware is an open headless commerce platform. In the Shopware CMS, the state handler for orders fails to sufficiently verify user authorizations for actions that modify the payment, delivery, and/or order status. Due to this inadequate implementation, users lacking 'write' permissions for orders are still able to change the order state. This issue has been addressed and users are advised to update to Shopware 6.5.7.4. For older versi