Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-45232 State: PUBLISHED Published: 2024-08-28T00:00:00 Last Updated: 2024-08-29T13:16:40.783Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in powermail extension through 12.3.5 for TYPO3. It fails to validate the mail parameter of the confirmationAction, resulting in Insecure Direct Object Reference (IDOR). An unauthenticated attacker can use this to display the user-submitted data of all forms persisted by the extension. This can only be exploited when the extension is configured to save submitted form data to the database (plugin.tx_powermail.settings.db.enable=1), which however is the default setting of the extension. The fixed version
ase (plugin.tx_powermail.settings.db.enable=1), which however is the default setting of the extension. The fixed versions are 7.5.0, 8.5.0, 10.9.0, and 12.4.0 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://typo3.org/security/advisory/typo3-ext-sa-2024-006
CVE ID: CVE-2024-45233 State: PUBLISHED Published: 2024-08-28T00:00:00 Last Updated: 2024-08-29T13:25:41.055Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in powermail extension through 12.3.5 for TYPO3. Several actions in the OutputController can directly be called, due to missing or insufficiently implemented access checks, resulting in Broken Access Control. Depending on the configuration of the Powermail Frontend plugins, an unauthenticated attacker can exploit this to edit, update, delete, or export data of persisted forms. This can only be exploited when the Powermail Frontend plugins are used. The fixed versions are 7.5.0, 8.5.0, 10.9.0, and 12.4.
n only be exploited when the Powermail Frontend plugins are used. The fixed versions are 7.5.0, 8.5.0, 10.9.0, and 12.4.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://typo3.org/security/advisory/typo3-ext-sa-2024-006
CVE ID: CVE-2024-45234 State: PUBLISHED Published: 2024-08-24T00:00:00.000Z Last Updated: 2025-11-03T20:39:02.238Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Fort before 1.6.3. A malicious RPKI repository that descends from a (trusted) Trust Anchor can serve (via rsync or RRDP) an ROA or a Manifest containing a signedAttrs encoded in non-canonical form. This bypasses Fort's BER decoder, reaching a point in the code that panics when faced with data not encoded in DER. Because Fort is an RPKI Relying Party, a panic can lead to Route Origin Validation unavailability, which can lead to compromised routing. Additional Analyst Notes: - CISA ADP Vulnrichme
Origin Validation unavailability, which can lead to compromised routing. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://nicmx.github.io/FORT-validator/CVE.html
CVE ID: CVE-2024-45235 State: PUBLISHED Published: 2024-08-24T00:00:00.000Z Last Updated: 2025-11-03T20:39:03.687Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Fort before 1.6.3. A malicious RPKI repository that descends from a (trusted) Trust Anchor can serve (via rsync or RRDP) a resource certificate containing an Authority Key Identifier extension that lacks the keyIdentifier field. Fort references this pointer without sanitizing it first. Because Fort is an RPKI Relying Party, a crash can lead to Route Origin Validation unavailability, which can lead to compromised routing. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container
ility, which can lead to compromised routing. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://nicmx.github.io/FORT-validator/CVE.html
CVE ID: CVE-2024-45236 State: PUBLISHED Published: 2024-08-24T00:00:00.000Z Last Updated: 2025-11-03T20:39:05.109Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Fort before 1.6.3. A malicious RPKI repository that descends from a (trusted) Trust Anchor can serve (via rsync or RRDP) a signed object containing an empty signedAttributes field. Fort accesses the set's elements without sanitizing it first. Because Fort is an RPKI Relying Party, a crash can lead to Route Origin Validation unavailability, which can lead to compromised routing. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://nicmx.github.io/FORT
. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://nicmx.github.io/FORT-validator/CVE.html
CVE ID: CVE-2024-45237 State: PUBLISHED Published: 2024-08-24T00:00:00.000Z Last Updated: 2025-11-03T20:39:06.541Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Fort before 1.6.3. A malicious RPKI repository that descends from a (trusted) Trust Anchor can serve (via rsync or RRDP) a resource certificate containing a Key Usage extension composed of more than two bytes of data. Fort writes this string into a 2-byte buffer without properly sanitizing its length, leading to a buffer overflow. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://nicmx.github.io/FORT-validator/CVE.html
CVE ID: CVE-2024-45238 State: PUBLISHED Published: 2024-08-24T00:00:00.000Z Last Updated: 2025-11-03T20:39:07.972Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Fort before 1.6.3. A malicious RPKI repository that descends from a (trusted) Trust Anchor can serve (via rsync or RRDP) a resource certificate containing a bit string that doesn't properly decode into a Subject Public Key. OpenSSL does not report this problem during parsing, and when compiled with OpenSSL libcrypto versions below 3, Fort recklessly dereferences the pointer. Because Fort is an RPKI Relying Party, a crash can lead to Route Origin Validation unavailability, which can lead to comp
ecause Fort is an RPKI Relying Party, a crash can lead to Route Origin Validation unavailability, which can lead to compromised routing. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://nicmx.github.io/FORT-validator/CVE.html
CVE ID: CVE-2024-45239 State: PUBLISHED Published: 2024-08-24T00:00:00.000Z Last Updated: 2025-11-03T20:39:09.358Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Fort before 1.6.3. A malicious RPKI repository that descends from a (trusted) Trust Anchor can serve (via rsync or RRDP) an ROA or a Manifest containing a null eContent field. Fort dereferences the pointer without sanitizing it first. Because Fort is an RPKI Relying Party, a crash can lead to Route Origin Validation unavailability, which can lead to compromised routing. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://nicmx.github.io/FORT-validat
onal Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://nicmx.github.io/FORT-validator/CVE.html
CVE ID: CVE-2024-45240 State: PUBLISHED Published: 2024-08-24T00:00:00 Last Updated: 2024-11-05T21:59:50.639Z Vendors: n/a Products: n/a Problem Types: n/a Description: The TikTok (aka com.zhiliaoapp.musically) application before 34.5.5 for Android allows the takeover of Lynxview JavaScript interfaces via deeplink traversal (in the application's exposed WebView). (On Android 12 and later, this is only exploitable by third-party applications.) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://hackerone.com/reports/2417516
CVE ID: CVE-2024-45241 State: PUBLISHED Published: 2024-08-26T00:00:00 Last Updated: 2024-08-26T15:24:47.333Z Vendors: n/a Products: n/a Problem Types: n/a Description: A traversal vulnerability in GeneralDocs.aspx in CentralSquare CryWolf (False Alarm Management) through 2024-08-09 allows unauthenticated attackers to read files outside of the working web directory via the rpt parameter, leading to the disclosure of sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.centralsquare.com/solutions/public-safety-software/public-safety-agency-operations/crywolf-false-alarm-management-solution - https://github.com/d4lyw/CVE-2024-45241/ - https://daly
fety-agency-operations/crywolf-false-alarm-management-solution - https://github.com/d4lyw/CVE-2024-45241/ - https://daly.wtf/cve-2024-45241-path-traversal-in-centralsquare-crywolf/
CVE ID: CVE-2024-45242 State: PUBLISHED Published: 2024-10-24T00:00:00 Last Updated: 2024-10-28T19:10:46.922Z Vendors: n/a Products: n/a Problem Types: n/a Description: EnGenius ENH1350EXT A8J-ENH1350EXT devices through 3.9.3.2_c1.9.51 allow (blind) OS Command Injection via shell metacharacters to the Ping or Speed Test utility. During the time of initial setup, the device creates an open unsecured network whose admin panel is configured with the default credentials of admin/admin. An unauthorized attacker in proximity to the Wi-Fi network can exploit this window of time to execute arbitrary OS commands with root-level permissions. Additional Analyst Notes: - CISA ADP Vulnrichment: Reference
execute arbitrary OS commands with root-level permissions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/actuator/cve/blob/main/Engenius/CVE-2024-45242_Extended_Report.pdf - https://github.com/actuator/cve/blob/main/Engenius/CVE-2024-45242
CVE ID: CVE-2024-45244 State: PUBLISHED Published: 2024-08-25T00:00:00.000Z Last Updated: 2025-10-06T14:30:08.614Z Vendors: n/a Products: n/a Problem Types: n/a Description: Hyperledger Fabric through 3.0.0 and 2.5.x through 2.5.9 do not verify that a request has a timestamp within the expected time window. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/hyperledger/fabric/commit/155457a6624b3c74b22e5729c35c8499bfe952cd - https://github.com/shanker-sec/HLF_TxTime_spoofing - https://github.com/shanker-sec/hlf-time-oracle
CVE ID: CVE-2024-45245 State: PUBLISHED Published: 2024-10-06T07:28:37.226Z Last Updated: 2024-10-07T15:36:39.497Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Diebold Nixdorf Products: Vynamic View prior Problem Types: CWE-200 Description: Diebold Nixdorf – CWE-200: Exposure of Sensitive Information to an Unauthorized Actor Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.gov.il/en/Departments/faq/cve_advisories
CVE ID: CVE-2024-45246 State: PUBLISHED Published: 2024-10-06T11:49:16.249Z Last Updated: 2024-10-07T15:35:51.388Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Diebold Nixdorf Products: Vynamic View prior to v5.9.5 Problem Types: CWE-427 Description: Diebold Nixdorf – CWE-427: Uncontrolled Search Path Element Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.gov.il/en/Departments/faq/cve_advisories
CVE ID: CVE-2024-45247 State: PUBLISHED Published: 2024-10-06T11:52:33.559Z Last Updated: 2024-10-07T15:25:13.920Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Sonarr Products: Sonarr Problem Types: CWE-601 Description: Sonarr – CWE-601: URL Redirection to Untrusted Site ('Open Redirect') Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.gov.il/en/Departments/faq/cve_advisories
CVE ID: CVE-2024-45248 State: PUBLISHED Published: 2024-10-06T12:20:54.071Z Last Updated: 2024-10-07T15:24:27.983Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Multi-DNC Products: Multi-DNC Problem Types: CWE-35 Description: Multi-DNC – CWE-35: Path Traversal: '.../...//' Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.gov.il/en/Departments/faq/cve_advisories
CVE ID: CVE-2024-45249 State: PUBLISHED Published: 2024-10-06T12:22:25.946Z Last Updated: 2024-10-07T15:07:47.911Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Cavok Products: Cavok Problem Types: CWE-89 Description: Cavok – CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.gov.il/en/Departments/faq/cve_advisories
CVE ID: CVE-2024-45250 State: PUBLISHED Published: 2024-10-06T12:24:03.945Z Last Updated: 2024-10-07T15:03:33.756Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: ZKteco Products: iClock v3.1-168 Problem Types: CWE-200 Description: ZKteco – CWE 200 Exposure of Sensitive Information to an Unauthorized Actor Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.gov.il/en/Departments/faq/cve_advisories
CVE ID: CVE-2024-45251 State: PUBLISHED Published: 2024-10-06T12:25:16.812Z Last Updated: 2024-10-07T15:02:39.181Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Elsight Products: Halo version 11.7.1.5 Problem Types: CWE-78 Description: Elsight – CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.gov.il/en/Departments/faq/cve_advisories
CVE ID: CVE-2024-45252 State: PUBLISHED Published: 2024-10-06T12:26:11.622Z Last Updated: 2024-10-07T15:01:36.906Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Elsight Products: Halo version 11.7.1.5 Problem Types: CWE-78 Description: Elsight – CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.gov.il/en/Departments/faq/cve_advisories
CVE ID: CVE-2024-45253 State: PUBLISHED Published: 2024-11-14T09:43:56.195Z Last Updated: 2024-11-14T15:09:55.880Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Avigilon Products: VideoIQ iCVR HD camera Problem Types: CWE-22 Description: Avigilon – CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.gov.il/en/Departments/faq/cve_advisories
CVE ID: CVE-2024-45254 State: PUBLISHED Published: 2024-11-14T09:46:05.295Z Last Updated: 2024-11-14T15:04:14.961Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: VaeMendis Products: VaeMendis Ubooquity version 2.1.2 Problem Types: CWE-79 Description: VaeMendis - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.gov.il/en/Departments/faq/cve_advisories
CVE ID: CVE-2024-45256 State: PUBLISHED Published: 2024-08-26T00:00:00 Last Updated: 2024-08-26T12:57:37.037Z Vendors: n/a Products: n/a Problem Types: n/a Description: An arbitrary file write issue in the exfiltration endpoint in BYOB (Build Your Own Botnet) 2.0 allows attackers to overwrite SQLite databases and bypass authentication via an unauthenticated HTTP request with a crafted parameter. This occurs in file_add in api/files/routes.py. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/malwaredllc/byob - https://blog.chebuya.com/posts/unauthenticated-remote-command-execution-on-byob/ - https://github.com/chebuya/exploits/tree/main/BYOB-RCE
CVE ID: CVE-2024-45258 State: PUBLISHED Published: 2024-08-25T00:00:00 Last Updated: 2024-08-26T13:25:02.790Z Vendors: n/a Products: n/a Problem Types: n/a Description: The req package before 3.43.4 for Go may send an unintended request when a malformed URL is provided, because cleanHost in http.go intentionally uses a "garbage in, garbage out" design. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/imroc/req/commit/04e3ece5b380ecad9da3551c449f1b8a9aa76d3d - https://github.com/imroc/req/compare/v3.43.3...v3.43.4
CVE ID: CVE-2024-45259 State: PUBLISHED Published: 2024-10-24T00:00:00 Last Updated: 2024-10-28T19:38:53.728Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. By intercepting an HTTP request and changing the filename property in the download interface, any file on the device can be deleted. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Delete%20Any%20File%20via%20Download%20Interface.md
CVE ID: CVE-2024-45260 State: PUBLISHED Published: 2024-10-24T00:00:00 Last Updated: 2024-10-28T19:27:01.398Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. Users who belong to unauthorized groups can invoke any interface of the device, thereby gaining complete control over it. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Unauthorized%20Access%20to%20File%20Download%20and%20Upload%20Interfaces.md
CVE ID: CVE-2024-45261 State: PUBLISHED Published: 2024-10-24T00:00:00 Last Updated: 2024-10-28T19:19:59.290Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. The SID generated for a specific user is not tied to that user itself, which allows other users to potentially use it for authentication. Once an attacker bypasses the application's authentication procedures, they can generate a valid SID, escalate privileges, and gain full control. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Bypassing%20Log
lyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Bypassing%20Login%20Mechanism%20with%20Passwordless%20User%20Login.md
CVE ID: CVE-2024-45262 State: PUBLISHED Published: 2024-10-24T00:00:00 Last Updated: 2024-10-28T19:22:25.505Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. The params parameter in the call method of the /rpc endpoint is vulnerable to arbitrary directory traversal, which enables attackers to execute scripts under any path. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Improper%20Pathname%20Restriction%20Leading%20to%20Path%20Traversal%20in%20Restricted%20Directories.md
CVE ID: CVE-2024-45263 State: PUBLISHED Published: 2024-10-24T00:00:00 Last Updated: 2024-10-28T18:52:30.245Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. The upload interface allows the uploading of arbitrary files to the device. Once the device executes the files, it can lead to information leakage, enabling complete control. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Arbitrary%20File%20Upload%20to%20ovpn_upload%20via%20Upload%20Interface.md
CVE ID: CVE-2024-45264 State: PUBLISHED Published: 2024-08-27T00:00:00 Last Updated: 2024-08-27T17:05:34.560Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site request forgery (CSRF) vulnerability in the admin panel in SkySystem Arfa-CMS before 5.1.3124 allows remote attackers to add a new administrator, leading to escalation of privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://skyss.ru - https://github.com/TheHermione/CVE-2024-45264
CVE ID: CVE-2024-45265 State: PUBLISHED Published: 2024-08-26T00:00:00 Last Updated: 2024-08-27T13:48:56.926Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection vulnerability in the poll component in SkySystem Arfa-CMS before 5.1.3124 allows remote attackers to execute arbitrary SQL commands via the psid parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://skyss.ru - https://github.com/TheHermione/CVE-2024-45265
CVE ID: CVE-2024-45269 State: PUBLISHED Published: 2024-09-01T23:55:16.802Z Last Updated: 2025-03-13T15:42:40.497Z Vendors: Sayful Islam Products: Carousel Slider Problem Types: Cross-site request forgery (CSRF) Description: WordPress plugin "Carousel Slider" provided by Sayful Islam contains a cross-site request forgery vulnerability on Carousel image selection feature. While logged in to the WordPress site with Carousel Slider plugin enabled, accessing a crafted page may cause a user to alter the contents of the WordPress site. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/sayful1/carousel-slider - https://wordpress.org/plugins/carousel-slider/ - https
hment: References: - https://github.com/sayful1/carousel-slider - https://wordpress.org/plugins/carousel-slider/ - https://jvn.jp/en/jp/JVN25264194/
CVE ID: CVE-2024-45270 State: PUBLISHED Published: 2024-09-01T23:55:28.098Z Last Updated: 2025-03-13T19:57:46.459Z Vendors: Sayful Islam Products: Carousel Slider Problem Types: Cross-site request forgery (CSRF) Description: WordPress plugin "Carousel Slider" provided by Sayful Islam contains a cross-site request forgery vulnerability on Hero image selection feature. While logged in to the WordPress site with Carousel Slider plugin enabled, accessing a crafted page may cause a user to alter the contents of the WordPress site. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/sayful1/carousel-slider - https://wordpress.org/plugins/carousel-slider/ - https://j
t: References: - https://github.com/sayful1/carousel-slider - https://wordpress.org/plugins/carousel-slider/ - https://jvn.jp/en/jp/JVN25264194/
CVE ID: CVE-2024-45271 State: PUBLISHED Published: 2024-10-15T10:27:06.004Z Last Updated: 2025-08-26T14:14:12.044Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: MB connect line, Helmholz Products: mbNET.mini, REX100 Problem Types: CWE-94 Description: An unauthenticated local attacker can gain admin privileges by deploying a config file due to improper input validation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cert.vde.com/en/advisories/VDE-2024-056 - https://cert.vde.com/en/advisories/VDE-2024-066
CVE ID: CVE-2024-45272 State: PUBLISHED Published: 2024-10-15T10:27:32.688Z Last Updated: 2024-10-16T17:36:22.123Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: MB connect line, Helmholz Products: mbCONNECT24, mymbCONNECT24, myREX24 V2, myREX24.virtual Problem Types: CWE-1391 Description: An unauthenticated remote attacker can perform a brute-force attack on the credentials of the remote service portal with a high chance of success, resulting in connection lost. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cert.vde.com/en/advisories/VDE-2024-068 - https://cert.vde.com/en/advisories/VDE-2024-069
CVE ID: CVE-2024-45273 State: PUBLISHED Published: 2024-10-15T10:27:52.208Z Last Updated: 2024-10-16T17:47:04.737Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: MB connect line, Helmholz Products: mbNET.mini, mbNET/mbNET.rokey, mbNET HW1, mbSPIDER, mbCONNECT24, mymbCONNECT24, REX100, REX200/250, myREX24 V2, myREX24.virtual, REX300 Problem Types: CWE-261 Description: An unauthenticated local attacker can decrypt the devices config file and therefore compromise the device due to a weak implementation of the encryption used. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cert.vde.com/en/advisories/VDE-2024-056
Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cert.vde.com/en/advisories/VDE-2024-056 - https://cert.vde.com/en/advisories/VDE-2024-066 - https://cert.vde.com/en/advisories/VDE-2024-068 - https://cert.vde.com/en/advisories/VDE-2024-069