Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-8422 State: PUBLISHED Published: 2024-10-08T10:09:34.543Z Last Updated: 2024-10-08T13:51:54.776Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Schneider Electric Products: Zelio Soft 2 Problem Types: CWE-416 Description: CWE-416: Use After Free vulnerability exists that could cause arbitrary code execution, denial of service and loss of confidentiality & integrity when application user opens a malicious Zelio Soft 2 project file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-282-06&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-282-06.pdf
CVE ID: CVE-2024-8424 State: PUBLISHED Published: 2024-11-07T23:27:50.279Z Last Updated: 2024-11-08T15:28:51.297Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: WatchGuard Products: EPDR, Panda AD360, Panda Dome Problem Types: CWE-269 Description: Improper Privilege Management vulnerability in WatchGuard EPDR, Panda AD360 and Panda Dome on Windows (PSANHost.exe module) allows arbitrary file delete with SYSTEM permissions. This issue affects EPDR: before 8.00.23.0000; Panda AD360: before 8.00.23.0000; Panda Dome: before 22.03.00. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2024-00017
CVE ID: CVE-2024-8425 State: PUBLISHED Published: 2025-02-28T08:23:16.648Z Last Updated: 2025-02-28T13:25:10.969Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: WP Swings Products: WooCommerce Ultimate Gift Card Problem Types: CWE-434 Description: The WooCommerce Ultimate Gift Card plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'mwb_wgm_preview_mail' and 'mwb_wgm_woocommerce_add_cart_item_data' functions in all versions up to, and including, 2.6.0. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution po
nauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6ebffb82-7455-40c9-9ffd-b78e0e73e431?source=cve - https://codecanyon.net/item/woocommerce-ultimate-gift-card/19191057
CVE ID: CVE-2024-8426 State: PUBLISHED Published: 2025-05-15T20:07:15.558Z Last Updated: 2025-05-17T03:14:31.922Z Vendors: Unknown Products: Page Builder: Pagelayer Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Page Builder: Pagelayer WordPress plugin before 1.8.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/f81b7478-c775-45ff-bbb8-d13c3f58acc6/
CVE ID: CVE-2024-8427 State: PUBLISHED Published: 2024-09-06T06:50:54.701Z Last Updated: 2024-09-06T13:28:13.067Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: wpshuffle Products: Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin Problem Types: CWE-862 Description: The Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_global_settings and process_form_edit functions in all versions up to, and including, 1.2.2. This makes it possible for authenticated attackers, with Subscriber-level access and
sions up to, and including, 1.2.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the plugin's settings and forms. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e84b68b6-1ce8-45fb-823f-a61158aa4d21?source=cve - https://plugins.trac.wordpress.org/changeset/3147218/frontend-post-submission-manager-lite/trunk/includes/classes/admin/class-fpsml-ajax-admin.php - https://plugins.trac.wordpress.org/browser/frontend-post-submission-manager-lite/tags/1.2.2/includes/classes/admin/class-fpsml-ajax-admin.php#L25
CVE ID: CVE-2024-8428 State: PUBLISHED Published: 2024-09-06T13:55:18.650Z Last Updated: 2024-09-06T14:11:40.631Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: ultimatemember Products: ForumWP – Forum & Discussion Board Plugin Problem Types: CWE-639 Description: The ForumWP – Forum & Discussion Board Plugin plugin for WordPress is vulnerable to Privilege Escalation via Insecure Direct Object Reference in all versions up to, and including, 2.0.2 via the submit_form_handler due to missing validation on the 'user_id' user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to change the email address of ad
makes it possible for authenticated attackers, with subscriber-level access and above, to change the email address of administrative user accounts which can then be leveraged to reset the administrative users password and gain access to their account. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b5818587-0a52-4734-8f75-263b4ab5020e?source=cve - https://plugins.trac.wordpress.org/browser/forumwp/trunk/includes/frontend/class-actions-listener.php#L179
CVE ID: CVE-2024-8429 State: PUBLISHED Published: 2024-12-17T11:34:02.427Z Last Updated: 2024-12-17T14:31:11.679Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Digital Operation Services Products: WiFiBurada Problem Types: CWE-307, CWE-201 Description: Improper Restriction of Excessive Authentication Attempts vulnerability in Digital Operation Services WiFiBurada allows Use of Known Domain Credentials.This issue affects WiFiBurada: before 1.0.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-24-1888
CVE ID: CVE-2024-8430 State: PUBLISHED Published: 2024-10-01T08:30:19.110Z Last Updated: 2024-10-01T13:29:28.042Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: spicethemes Products: Spice Starter Sites Problem Types: CWE-862 Description: The Spice Starter Sites plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the spice_starter_sites_importer_creater function in all versions up to, and including, 1.2.5. This makes it possible for unauthenticated attackers to import demo content. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/i
dditional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ec52337f-bdd1-4632-853b-da86d64751e7?source=cve - https://plugins.trac.wordpress.org/browser/spice-starter-sites/tags/1.2.5/spice-starter-sites.php#L1123
CVE ID: CVE-2024-8431 State: PUBLISHED Published: 2024-10-08T11:34:18.616Z Last Updated: 2024-10-08T13:50:56.799Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: robosoft Products: Photo Gallery, Images, Slider in Rbs Image Gallery Problem Types: CWE-862 Description: The Photo Gallery, Images, Slider in Rbs Image Gallery plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ajaxGetGalleryJson() function in all versions up to, and including, 3.2.21. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve private post titles. Additional Analyst Notes: - CISA AD
attackers, with subscriber-level access and above, to retrieve private post titles. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/632c0a1a-6ac2-44c3-b66c-44fa4cf05b2d?source=cve - https://plugins.trac.wordpress.org/browser/robo-gallery/tags/3.2.21/includes/extensions/block/src/init.php#L105 - https://plugins.trac.wordpress.org/changeset/3162670/robo-gallery/trunk/includes/extensions/block/src/init.php
CVE ID: CVE-2024-8432 State: PUBLISHED Published: 2024-09-24T01:56:45.251Z Last Updated: 2024-09-24T13:52:18.826Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: webba-agency Products: Appointment & Event Booking Calendar Plugin – Webba Booking Problem Types: CWE-862 Description: The Appointment & Event Booking Calendar Plugin – Webba Booking plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_appearance() function in all versions up to, and including, 5.0.48. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify the booking form's CSS. Additiona
ossible for authenticated attackers, with Subscriber-level access and above, to modify the booking form's CSS. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/23b33b77-2e72-4959-bdce-646e968f2a73?source=cve - https://plugins.trac.wordpress.org/browser/webba-booking-lite/tags/5.0.48/includes/class-wbk-request-manager.php#L1986 - https://plugins.trac.wordpress.org/changeset/3152926/webba-booking-lite/trunk/includes/class-wbk-request-manager.php
CVE ID: CVE-2024-8433 State: PUBLISHED Published: 2024-10-08T09:33:14.205Z Last Updated: 2024-10-08T13:21:16.330Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: themehunk Products: Easy Mega Menu Plugin for WordPress – ThemeHunk Problem Types: CWE-79 Description: The Easy Mega Menu Plugin for WordPress – ThemeHunk plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘themehunk_megamenu_bg_image' parameter in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in page
it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Please note that this was partially fixed in 1.1.0 due to the missing authorization protection that was added. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/fc661cfd-6290-4b36-858a-cf2269b5fcf9?source=cve - https://plugins.trac.wordpress.org/browser/themehunk-megamenu-plus/trunk/inc/megamenu-base.php#L35 - https://plugins.trac.wordpress.org/browser/themehunk-megamenu-plus/tags/1.1.0/views/admin/item_settings.php?rev=3156084#L196 - https
ins.trac.wordpress.org/browser/themehunk-megamenu-plus/tags/1.1.0/views/admin/item_settings.php?rev=3156084#L196 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3163871%40themehunk-megamenu-plus&new=3163871%40themehunk-megamenu-plus&sfp_email=&sfph_mail=#file21
CVE ID: CVE-2024-8434 State: PUBLISHED Published: 2024-09-25T02:05:23.562Z Last Updated: 2024-09-25T13:30:29.959Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: themehunk Products: Easy Mega Menu Plugin for WordPress – ThemeHunk Problem Types: CWE-862 Description: The Easy Mega Menu Plugin for WordPress – ThemeHunk plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several functions hooked via AJAX in all versions up to, and including, 1.0.9. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform actions like updating plugin settings. Additional Analyst Notes: - CISA
th subscriber-level access and above, to perform actions like updating plugin settings. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/be3869a9-f72d-4bbb-ba51-d2761ca761f2?source=cve - https://plugins.trac.wordpress.org/changeset/3156084/themehunk-megamenu-plus/tags/1.1.0/inc/megamenu-base.php - https://plugins.trac.wordpress.org/changeset/3156084/themehunk-megamenu-plus/tags/1.1.0/inc/megamenu-setting.php - https://plugins.trac.wordpress.org/changeset/3156084/themehunk-megamenu-plus/tags/1.1.0/inc/megamenu-nav-menu-settings.php - https://plugins.trac.wordpress.org/changeset/3156084/themehunk-megamenu-plus/tags/1.1.0
megamenu-nav-menu-settings.php - https://plugins.trac.wordpress.org/changeset/3156084/themehunk-megamenu-plus/tags/1.1.0/inc/megamenu-widgets.php
CVE ID: CVE-2024-8436 State: PUBLISHED Published: 2024-09-24T07:30:46.464Z Last Updated: 2025-08-27T21:43:06.484Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: hahncgdev Products: WP Easy Gallery – WordPress Gallery Plugin Problem Types: CWE-89 Description: The WP Easy Gallery – WordPress Gallery Plugin plugin for WordPress is vulnerable to SQL Injection via the 'edit_imageId' and 'edit_imageDelete' parameters in all versions up to, and including, 4.8.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access a
reparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d6eb094a-4f5a-418a-ba95-635765abfcff?source=cve - https://plugins.trac.wordpress.org/browser/wp-easy-gallery/trunk/wp-easy-gallery.php#L730
CVE ID: CVE-2024-8437 State: PUBLISHED Published: 2024-09-24T07:30:45.969Z Last Updated: 2024-09-24T13:36:43.314Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: hahncgdev Products: WP Easy Gallery – WordPress Gallery Plugin Problem Types: CWE-862 Description: The WP Easy Gallery – WordPress Gallery Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several functions hooked via AJAX like wpeg_settings and wpeg_add_gallery in all versions up to, and including, 4.8.5. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify galleries. Additional Analyst Notes: - CIS
or authenticated attackers, with subscriber-level access and above, to modify galleries. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c8bd5021-4895-4b0e-b517-186959f76095?source=cve - https://plugins.trac.wordpress.org/browser/wp-easy-gallery/trunk/wp-easy-gallery.php#L42
CVE ID: CVE-2024-8438 State: PUBLISHED Published: 2025-03-20T10:09:49.971Z Last Updated: 2025-03-20T18:34:01.364Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: modelscope Products: modelscope/agentscope Problem Types: CWE-22 Description: A path traversal vulnerability exists in modelscope/agentscope version v.0.0.4. The API endpoint `/api/file` does not properly sanitize the `path` parameter, allowing an attacker to read arbitrary files on the server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/3f170c58-42ee-422d-ab6f-32c7aa05b974
CVE ID: CVE-2024-8439 State: REJECTED Published: N/A Last Updated: 2024-09-06T21:21:17.639Z Description: No description available.
CVE ID: CVE-2024-8440 State: PUBLISHED Published: 2024-09-11T06:42:25.138Z Last Updated: 2024-09-11T13:16:19.770Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wpdevteam Products: Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders Problem Types: CWE-79 Description: The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Fancy Text widget in all versions up to, and including, 6.0.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it
d including, 6.0.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c5960396-5320-4978-aa82-2e33700daa43?source=cve - https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/trunk/includes/Elements/Fancy_Text.php#L114 - https://wordpress.org/plugins/essential-addons-for-elementor-lite/#developers - https://plugins.trac
ncy_Text.php#L114 - https://wordpress.org/plugins/essential-addons-for-elementor-lite/#developers - https://plugins.trac.wordpress.org/changeset/3148624/
CVE ID: CVE-2024-8441 State: PUBLISHED Published: 2024-09-10T21:01:09.475Z Last Updated: 2024-09-12T03:55:23.682Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Ivanti Products: Endpoint Manager Problem Types: CWE-427 Description: An uncontrolled search path in the agent of Ivanti EPM before 2022 SU6, or the 2024 September update allows a local authenticated attacker with admin privileges to escalate their privileges to SYSTEM. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-EPM-September-2024-for-EPM-2024-and-EPM-2022
CVE ID: CVE-2024-8442 State: PUBLISHED Published: 2024-11-07T12:30:52.999Z Last Updated: 2024-11-07T14:06:06.937Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: bdthemes Products: Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider) Problem Types: CWE-79 Description: The Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Blog widget in all versions up to, and including, 3.15.18 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authen
ue to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/eff765b4-22d1-4311-8a69-af6b41ef4b6e?source=cve - https://plugins.trac.wordpress.org/browser/bdthemes-prime-slider-lite/trunk/traits/global-widget-controls.php#L2328 - https://wordpress.org/plugins/bdthemes-prime-slider-lite/#developers - https://plugins.trac.wordpress.org/changeset/3182825/
CVE ID: CVE-2024-8443 State: PUBLISHED Published: 2024-09-10T13:16:51.146Z Last Updated: 2025-11-07T00:36:45.462Z Severity: LOW (CVSS 2.9 CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: Red Hat Products: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 Problem Types: CWE-122 Description: A heap-based buffer overflow vulnerability was found in the libopensc OpenPGP driver. A crafted USB device or smart card with malicious responses to the APDUs during the card enrollment process using the `pkcs15-init` tool may lead to out-of-bound rights, possibly resulting in arbitrary code execution. Additional Analyst Notes: - CISA ADP
l may lead to out-of-bound rights, possibly resulting in arbitrary code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/security/cve/CVE-2024-8443 - https://bugzilla.redhat.com/show_bug.cgi?id=2310494
CVE ID: CVE-2024-8444 State: PUBLISHED Published: 2024-10-30T06:00:03.652Z Last Updated: 2024-10-30T13:38:38.940Z Vendors: Unknown Products: Download Manager Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Download Manager WordPress plugin before 3.3.00 doesn't sanitize some of it's shortcode parameters, leading to cross site scripting. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/bf2f5aa8-a161-43ff-a6ee-8603aaba8012/
CVE ID: CVE-2024-8445 State: PUBLISHED Published: 2024-09-05T14:24:01.125Z Last Updated: 2025-11-06T23:16:47.118Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 7 Extended Lifecycle Support, Red Hat Directory Server 11, Red Hat Directory Server 12, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 Problem Types: CWE-20 Description: The fix for CVE-2024-2199 in 389-ds-base was insufficient to cover all scenarios. In certain product versions, an authenticated user may cause a server crash while modifying `userPassword` using malformed input. Additional Ana
ons, an authenticated user may cause a server crash while modifying `userPassword` using malformed input. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2024:7434 - https://access.redhat.com/security/cve/CVE-2024-8445 - https://bugzilla.redhat.com/show_bug.cgi?id=2310110
CVE ID: CVE-2024-8447 State: PUBLISHED Published: 2025-01-02T20:19:29.671Z Last Updated: 2025-11-11T00:43:36.485Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Red Hat Products: Red Hat JBoss EAP XP 5.0 Update 2.0, Red Hat JBoss Enterprise Application Platform 8, Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8, Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9, Red Hat JBoss Data Grid 7, Red Hat JBoss Enterprise Application Platform 7, Red Hat JBoss Enterprise Application Platform Expansion Pack Problem Types: CWE-833 Description: A security issue was discovered in the LRA Coordinator component of Narayana. When Cancel is called in
833 Description: A security issue was discovered in the LRA Coordinator component of Narayana. When Cancel is called in LRA, an execution time of approximately 2 seconds occurs. If Join is called with the same LRA ID within that timeframe, the application may crash or hang indefinitely, leading to a denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2025:3357 - https://access.redhat.com/errata/RHSA-2025:3358 - https://access.redhat.com/errata/RHSA-2025:7620 - https://access.redhat.com/security/cve/CVE-2024-8447 - https://bugzilla.redhat.com/show_bug.cgi?id=2335206 - https://github.com/jbosstm/narayana/pull/2293
CVE ID: CVE-2024-8448 State: PUBLISHED Published: 2024-09-30T06:36:54.835Z Last Updated: 2024-09-30T17:06:56.559Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: PLANET Technology Products: GS-4210-24PL4C hardware 2.0, GS-4210-24P2S hardware 3.0 Problem Types: CWE-798 Description: Certain switch models from PLANET Technology have a hard-coded credential in the specific command-line interface, allowing remote attackers with regular privilege to log in with this credential and obtain a Linux root shell. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-8045-a2804-1.html - https://www.twcert.org.tw/en/cp-139-8046
richment: References: - https://www.twcert.org.tw/tw/cp-132-8045-a2804-1.html - https://www.twcert.org.tw/en/cp-139-8046-057c2-2.html