Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-28026 State: PUBLISHED Published: 2024-11-21T14:41:20.234Z Last Updated: 2025-11-03T21:54:17.509Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: MC Technologies Products: MC LR Router Problem Types: CWE-78 Description: Three OS command injection vulnerabilities exist in the web interface I/O configuration functionality of MC Technologies MC LR Router 2.10.5. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.This vulnerability refers to the authenticated OS Command Injection that occurs through the attacker-controlled `out1` parameter, a
ability refers to the authenticated OS Command Injection that occurs through the attacker-controlled `out1` parameter, at offset `0x8efc`. int out_ret = sscanf(current_param->key, "out%u", &io_idx); if (out_ret == 1 && io_idx == 1) { // [4] Similar to `3`, but `out1` instead of `btn1` if (asprintf(&command, "/usr/sbin/vout %s %u vo_manual", current_param->value, 1) > 0) { system(command); return -1; } } Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2024-1953
CVE ID: CVE-2024-28027 State: PUBLISHED Published: 2024-11-21T14:41:20.405Z Last Updated: 2025-11-03T21:54:18.966Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: MC Technologies Products: MC LR Router Problem Types: CWE-78 Description: Three OS command injection vulnerabilities exist in the web interface I/O configuration functionality of MC Technologies MC LR Router 2.10.5. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.This vulnerability refers to the authetnicated OS Command injection that occurs through the attacker-controlled `timer1` parameter,
ability refers to the authetnicated OS Command injection that occurs through the attacker-controlled `timer1` parameter, at offset `0x8e80`. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2024-1953
CVE ID: CVE-2024-28028 State: PUBLISHED Published: 2024-11-13T21:12:07.212Z Last Updated: 2024-11-14T19:36:29.090Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) Neural Compressor software Problem Types: escalation of privilege, CWE-20 Description: Improper input validation in some Intel(R) Neural Compressor software before version v3.0 may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01219.html
CVE ID: CVE-2024-28029 State: PUBLISHED Published: 2024-03-21T22:04:57.512Z Last Updated: 2024-10-17T18:45:56.861Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Delta Electronics Products: DIAEnergie Problem Types: CWE-602 Description: Privileges are not fully verified server-side, which can be abused by a user with limited privileges to bypass authorization and access privileged functionality. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-074-12
CVE ID: CVE-2024-28030 State: PUBLISHED Published: 2024-11-13T21:05:56.770Z Last Updated: 2024-11-14T19:46:44.208Z Severity: LOW (CVSS 2.2 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L) Vendors: n/a Products: Intel(R) VPL software Problem Types: denial of service, CWE-395 Description: NULL pointer dereference in some Intel(R) VPL software before version 24.1.4 may allow an authenticated user to potentially enable denial of service via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01131.html
CVE ID: CVE-2024-28033 State: PUBLISHED Published: 2024-03-26T09:34:07.760Z Last Updated: 2024-08-02T17:11:00.897Z Vendors: LunarNight Laboratory Products: WebProxy Problem Types: OS command injection Description: OS command injection vulnerability exists in WebProxy 1.7.8 and 1.7.9, which may allow a remote unauthenticated attacker to execute an arbitrary OS command with the privilege of the running web server. Note that the developer was unreachable, therefore, users should consider stop using WebProxy 1.7.8 and 1.7.9. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jvn.jp/en/jp/JVN22376992/
CVE ID: CVE-2024-28034 State: PUBLISHED Published: 2024-03-26T09:36:04.246Z Last Updated: 2024-11-05T14:33:33.474Z Vendors: Flash CGI Products: Mini Thread Problem Types: Cross-site scripting (XSS) Description: Cross-site scripting vulnerability exists in Mini Thread Version 3.33βi. An arbitrary script may be executed on the web browser of the user accessing the website that uses the product. Note that the developer was unreachable, therefore, users should consider stop using Mini Thread Version 3.33βi. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://jvn.jp/en/jp/JVN40523785/
CVE ID: CVE-2024-28036 State: PUBLISHED Published: 2025-05-13T21:02:53.126Z Last Updated: 2025-05-14T17:15:48.894Z Severity: MEDIUM (CVSS 5.6 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H) Vendors: n/a Products: Intel(R) Arc™ GPU Problem Types: Denial of Service, CWE-754 Description: Improper conditions check for some Intel(R) Arc™ GPU may allow an authenticated user to potentially enable denial of service via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01252.html
CVE ID: CVE-2024-28038 State: PUBLISHED Published: 2024-11-26T07:37:06.324Z Last Updated: 2025-11-04T17:19:37.778Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Sharp Corporation, Toshiba Tec Corporation Products: Multiple MFPs (multifunction printers) Problem Types: CWE-121 Description: The web interface of the affected devices processes a cookie value improperly, leading to a stack buffer overflow. More precisely, giving too long character string to MFPSESSIONID parameter results in a stack buffer overflow. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [
d product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References]. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://global.sharp/products/copier/info/info_security_2024-05.html - https://jp.sharp/business/print/information/info_security_2024-05.html - https://www.toshibatec.com/information/20240531_02.html - https://www.toshibatec.co.jp/information/20240531_02.html - https://jvn.jp/en/vu/JVNVU93051062/ - https://pierrekim.github.io/blog/2024-06-27-sharp-mfp-17-vulnerabilities.html
CVE ID: CVE-2024-28039 State: PUBLISHED Published: 2024-03-18T08:13:26.248Z Last Updated: 2024-08-02T00:48:47.824Z Vendors: unclebob Products: FitNesse Problem Types: XML external entities (XXE) Description: Improper restriction of XML external entity references vulnerability exists in FitNesse all releases, which allows a remote unauthenticated attacker to obtain sensitive information, alter data, or cause a denial-of-service (DoS) condition. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/unclebob/fitnesse - http://fitnesse.org/FitNesseDownload - https://github.com/unclebob/fitnesse/blob/master/SECURITY.md - https://jvn.jp/en/jp/
p://fitnesse.org/FitNesseDownload - https://github.com/unclebob/fitnesse/blob/master/SECURITY.md - https://jvn.jp/en/jp/JVN94521208/
CVE ID: CVE-2024-28040 State: PUBLISHED Published: 2024-03-21T22:13:40.119Z Last Updated: 2024-08-12T20:14:25.821Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Delta Electronics Products: DIAEnergie Problem Types: CWE-89 Description: SQL injection vulnerability exists in GetDIAE_astListParameters. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-074-12
CVE ID: CVE-2024-28041 State: PUBLISHED Published: 2024-03-25T03:42:17.754Z Last Updated: 2025-03-28T07:39:02.488Z Vendors: KDDI CORPORATION Products: HGW BL1500HM Problem Types: Arbitrary command execution Description: HGW BL1500HM Ver 002.001.013 and earlier allows a network-adjacent unauthenticated attacker to execute an arbitrary command. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://kddi-tech.com/contents/appendix_L2_06.html#20304f4c-af1b-49fd-c3b5-8d1f55fd8b4f - https://jvn.jp/en/vu/JVNVU93546510/
CVE ID: CVE-2024-28042 State: PUBLISHED Published: 2024-05-15T16:44:19.227Z Last Updated: 2024-08-02T00:48:47.733Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: SUBNET Products: PowerSYSTEM Center Problem Types: CWE-1357 Description: SUBNET Solutions Inc. has identified vulnerabilities in third-party components used in PowerSYSTEM Center. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-135-02
CVE ID: CVE-2024-28044 State: PUBLISHED Published: 2024-09-02T03:24:52.604Z Last Updated: 2024-09-03T14:57:32.620Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: OpenHarmony Products: OpenHarmony Problem Types: CWE-190 Description: in OpenHarmony v4.1.0 and prior versions allow a local attacker cause crash through integer overflow. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2024/2024-09.md
CVE ID: CVE-2024-28045 State: PUBLISHED Published: 2024-03-21T22:24:12.286Z Last Updated: 2024-08-02T00:48:47.822Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: Delta Electronics Products: DIAEnergie Problem Types: CWE-79 Description: Improper neutralization of input within the affected product could lead to cross-site scripting. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-074-12
CVE ID: CVE-2024-28046 State: PUBLISHED Published: 2024-08-14T13:45:26.495Z Last Updated: 2024-08-14T14:39:36.473Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) GPA software Problem Types: escalation of privilege, CWE-427 Description: Uncontrolled search path in some Intel(R) GPA software before version 2024.1 may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01105.html
CVE ID: CVE-2024-28047 State: PUBLISHED Published: 2025-02-12T21:19:36.237Z Last Updated: 2025-11-03T20:37:05.533Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N) Vendors: n/a Products: Intel(R) Processors Problem Types: Information Disclosure, CWE-20 Description: Improper input validation in UEFI firmware for some Intel(R) Processors may allow a privileged user to potentially enable information disclosure via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01139.html
CVE ID: CVE-2024-28048 State: PUBLISHED Published: 2024-03-26T09:37:32.711Z Last Updated: 2024-08-07T20:10:05.116Z Vendors: Fortunefield Products: ffBull Problem Types: OS command injection Description: OS command injection vulnerability exists in ffBull ver.4.11, which may allow a remote unauthenticated attacker to execute an arbitrary OS command with the privilege of the running web server. Note that the developer was unreachable, therefore, users should consider stop using ffBull ver.4.11. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jvn.jp/en/jp/JVN17176449/
CVE ID: CVE-2024-28049 State: PUBLISHED Published: 2024-11-13T20:36:12.489Z Last Updated: 2024-11-13T20:49:43.787Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) Vendors: n/a Products: Intel(R) PROSet/Wireless Software and Intel(R) Killer(TM) Wi-Fi wireless products Problem Types: denial of service, CWE-20 Description: Improper input validation in firmware for some Intel(R) PROSet/Wireless Software and Intel(R) Killer(TM) Wi-Fi wireless products before version 23.40 may allow an unauthenticated user to enable denial of service via adjacent access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center
Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01108.html
CVE ID: CVE-2024-28050 State: PUBLISHED Published: 2024-08-14T13:45:16.572Z Last Updated: 2024-08-16T15:48:07.136Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H) Vendors: n/a Products: Intel(R) Arc(TM) & Iris(R) Xe Graphics software Problem Types: denial of service, CWE-284 Description: Improper access control in some Intel(R) Arc(TM) & Iris(R) Xe Graphics software before version 31.0.101.4824 may allow an authenticated user to potentially enable denial of service via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01130.html
CVE ID: CVE-2024-28051 State: PUBLISHED Published: 2024-11-13T21:04:10.094Z Last Updated: 2024-11-14T19:46:52.066Z Severity: LOW (CVSS 2.2 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N) Vendors: n/a Products: Intel(R) VPL software Problem Types: information disclosure, CWE-125 Description: Out-of-bounds read in some Intel(R) VPL software before version 24.1.4 may allow an authenticated user to potentially enable information disclosure via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01131.html
CVE ID: CVE-2024-28052 State: PUBLISHED Published: 2024-10-30T13:35:14.618Z Last Updated: 2024-10-30T15:03:07.955Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: LevelOne Products: WBR-6012 Problem Types: CWE-131 Description: The WBR-6012 is a wireless SOHO router. It is a low-cost device which functions as an internet gateway for homes and small offices while aiming to be easy to configure and operate. In addition to providing a WiFi access point, the device serves as a 4-port wired router and implements a variety of common SOHO router capabilities such as port forwarding, quality-of-service, web-based administration, a DHCP server, a basic DMZ, and UPnP c
pabilities such as port forwarding, quality-of-service, web-based administration, a DHCP server, a basic DMZ, and UPnP capabilities. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2024-1997
CVE ID: CVE-2024-28053 State: PUBLISHED Published: 2024-03-15T09:08:04.993Z Last Updated: 2024-08-12T13:40:25.079Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: Mattermost Products: Mattermost Problem Types: CWE-400 Description: Resource Exhaustion in Mattermost Server versions 8.1.x before 8.1.10 fails to limit the size of the payload that can be read and parsed allowing an attacker to send a very large email payload and crash the server. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2024-28054 State: PUBLISHED Published: 2024-03-18T00:00:00.000Z Last Updated: 2025-11-04T22:06:05.674Z Vendors: n/a Products: n/a Problem Types: n/a Description: Amavis before 2.12.3 and 2.13.x before 2.13.1, in part because of its use of MIME-tools, has an Interpretation Conflict (relative to some mail user agents) when there are multiple boundary parameters in a MIME email message. Consequently, there can be an incorrect check for banned files or malware. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.amavis.org/release-notes.txt - https://metacpan.org/pod/MIME::Tools - https://gitlab.com/amavis/amavis/-/issues/112 - https:
is.org/release-notes.txt - https://metacpan.org/pod/MIME::Tools - https://gitlab.com/amavis/amavis/-/issues/112 - https://gitlab.com/amavis/amavis/-/raw/v2.13.1/README_FILES/README.CVE-2024-28054 - https://lists.amavis.org/pipermail/amavis-users/2024-March/006811.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6J2MK2CS3KNJOS66QLW2MBJ4PIDLWJP5/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CDF6M3UXP45INVSWB4HXEDZH35CVZIJ4/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XQQQQPTZ5JHXTUCYUXZHY6RZJ6VOGOAJ/
CVE ID: CVE-2024-28056 State: PUBLISHED Published: 2024-04-15T00:00:00.000Z Last Updated: 2025-03-20T18:58:39.089Z Vendors: n/a Products: n/a Problem Types: n/a Description: Amazon AWS Amplify CLI before 12.10.1 incorrectly configures the role trust policy of IAM roles associated with Amplify projects. When the Authentication component is removed from an Amplify project, a Condition property is removed but "Effect":"Allow" remains present, and consequently sts:AssumeRoleWithWebIdentity would be available to threat actors with no conditions. Thus, if Amplify CLI had been used to remove the Authentication component from a project built between August 2019 and January 2024, an "assume role" may
d to remove the Authentication component from a project built between August 2019 and January 2024, an "assume role" may have occurred, and may have been leveraged to obtain unauthorized access to an organization's AWS resources. NOTE: the problem could only occur if an authorized AWS user removed an Authentication component. (The vulnerability did not give a threat actor the ability to remove an Authentication component.) However, in realistic situations, an authorized AWS user may have removed an Authentication component, e.g., if the objective were to stop using built-in Cognito resources, or move to a completely different identity provider. Additional Analyst Notes: - CVE Program Contain
Cognito resources, or move to a completely different identity provider. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/aws-amplify/amplify-cli/releases/tag/v12.10.1 - https://github.com/aws-amplify/amplify-cli/commit/73b08dc424db2fb60399c5343c314e02e849d4a1 - https://github.com/aws-amplify/amplify-cli/blob/8ad57bf99a404f3c92547c8a175458016f682fac/packages/amplify-provider-awscloudformation/resources/update-idp-roles-cfn.json - https://securitylabs.datadoghq.com/articles/amplified-exposure-how-aws-flaws-made-amplify-iam-roles-vulnerable-to-takeover/ - https://aws.amazon.com/security/security-bulletins/AWS-2024-003/
CVE ID: CVE-2024-28058 State: PUBLISHED Published: 2024-11-18T00:00:00 Last Updated: 2024-11-21T16:58:23.034Z Vendors: n/a Products: n/a Problem Types: n/a Description: In RSA NetWitness (NW) Platform before 12.5.1, even when an administrator revokes the access of a specific user with an active session, an internal threat actor could impersonate the revoked user and gain unauthorized access to sensitive data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://community.netwitness.com/t5/netwitness-platform-online/tkb-p/netwitness-online-documentation - https://community.netwitness.com/t5/netwitness-platform-product/nw-2024-06-netwitness-platform-broken-access-control/ta
https://community.netwitness.com/t5/netwitness-platform-product/nw-2024-06-netwitness-platform-broken-access-control/ta-p/719454
CVE ID: CVE-2024-28060 State: PUBLISHED Published: 2024-05-28T19:56:27.110Z Last Updated: 2025-05-30T16:03:07.437Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Apiris Kafeo 6.4.4. It permits DLL hijacking, allowing a user to trigger the execution of arbitrary code every time the product is executed. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://excellium-services.com/cert-xlm-advisory/cve-2024-28060/ - https://cds.thalesgroup.com/en/tcs-cert/CVE-2024-28060
CVE ID: CVE-2024-28061 State: PUBLISHED Published: 2024-05-28T19:35:35.950Z Last Updated: 2025-05-30T16:03:01.782Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Apiris Kafeo 6.4.4. It permits a bypass, of the protection in place, to access to the data stored in the embedded database file. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://excellium-services.com/cert-xlm-advisory/cve-2024-28061/ - https://cds.thalesgroup.com/en/tcs-cert/CVE-2024-28061
CVE ID: CVE-2024-28063 State: PUBLISHED Published: 2024-05-18T21:55:53.867Z Last Updated: 2025-02-13T15:47:33.522Z Vendors: n/a Products: n/a Problem Types: n/a Description: Kiteworks Totemomail through 7.0.0 allows /responsiveUI/EnvelopeOpenServlet envelopeRecipient reflected XSS. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.objectif-securite.ch/advisories/totemomail-reflected-xss.txt
CVE ID: CVE-2024-28064 State: PUBLISHED Published: 2024-05-18T22:02:03.643Z Last Updated: 2025-02-13T15:47:34.149Z Vendors: n/a Products: n/a Problem Types: n/a Description: Kiteworks Totemomail 7.x and 8.x before 8.3.0 allows /responsiveUI/EnvelopeOpenServlet messageId directory traversal for unauthenticated file read and delete operations (with displayLoginChunkedImages) and write operations (with storeLoginChunkedImages). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.objectif-securite.ch/advisories/totemomail-path-traversal.txt
CVE ID: CVE-2024-28065 State: PUBLISHED Published: 2024-04-05T00:00:00.000Z Last Updated: 2025-03-28T19:25:10.060Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Unify CP IP Phone firmware 1.10.4.3, files are not encrypted and contain sensitive information such as the root password hash. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://syss.de - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-007.txt
CVE ID: CVE-2024-28066 State: PUBLISHED Published: 2024-04-08T00:00:00 Last Updated: 2024-08-15T14:44:40.826Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Unify CP IP Phone firmware 1.10.4.3, Weak Credentials are used (a hardcoded root password). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://syss.de - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-008.txt
CVE ID: CVE-2024-28067 State: PUBLISHED Published: 2024-07-09T00:00:00 Last Updated: 2024-10-30T18:43:16.096Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AC:H/AV:A/A:N/C:N/I:H/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability in Samsung Exynos Modem 5300 allows a Man-in-the-Middle (MITM) attacker to downgrade the security mode of packets going to the victim, enabling the attacker to send messages to the victim in plaintext. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://semiconductor.samsung.com/support/quality-support/product-security-updates/ - https://semiconductor.samsung.com/support/quality-support/produc