Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-52515 State: PUBLISHED Published: 2024-11-15T17:03:09.033Z Last Updated: 2024-11-15T17:32:49.770Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N) Vendors: nextcloud Products: security-advisories Problem Types: CWE-706 Description: Nextcloud Server is a self hosted personal cloud system. After an admin enables the default-disabled SVG preview provider, a malicious user could upload a manipulated SVG file referencing paths. If the file would exist the preview of the SVG would preview the other file instead. It is recommended that the Nextcloud Server is upgraded to 27.1.10, 28.0.6 or 29.0.1 and Nextcloud Enterprise Server is upgraded to 24.0.12.15, 25.
Nextcloud Server is upgraded to 27.1.10, 28.0.6 or 29.0.1 and Nextcloud Enterprise Server is upgraded to 24.0.12.15, 25.0.13.10, 26.0.13.4, 27.1.10, 28.0.6 or 29.0.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-5m5g-hw8c-2236 - https://github.com/nextcloud/server/pull/45340 - https://github.com/nextcloud/server/commit/7e1c30f82a63fbea8c269e0eec38291377f32604 - https://hackerone.com/reports/2484499
CVE ID: CVE-2024-52516 State: PUBLISHED Published: 2024-11-15T16:55:18.934Z Last Updated: 2024-11-15T17:32:26.732Z Severity: LOW (CVSS 3 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:N/A:N) Vendors: nextcloud Products: security-advisories Problem Types: CWE-269 Description: Nextcloud Server is a self hosted personal cloud system. When a server is configured to only allow sharing with users that are in ones own groups, after a user was removed from a group, previously shared items were not unshared. It is recommended that the Nextcloud Server is upgraded to 22.2.11 or 23.0.11 or 24.0.6 and Nextcloud Enterprise Server is upgraded to 22.2.11 or 23.0.11 or 24.0.6. Additional Analyst Notes: - CISA ADP V
.0.6 and Nextcloud Enterprise Server is upgraded to 22.2.11 or 23.0.11 or 24.0.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-35gc-jc6x-29cm - https://github.com/nextcloud/server/pull/47180 - https://github.com/nextcloud/server/commit/142b6e313ffa9d3b950bcd23cb58850d3ae7cf34
CVE ID: CVE-2024-52517 State: PUBLISHED Published: 2024-11-15T16:49:40.993Z Last Updated: 2024-11-15T17:32:03.847Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:P/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N) Vendors: nextcloud Products: security-advisories Problem Types: CWE-200 Description: Nextcloud Server is a self hosted personal cloud system. After storing "Global credentials" on the server, the API returns them and adds them into the frontend again, allowing to read them in plain text when an attacker already has access to an active session of a user. It is recommended that the Nextcloud Server is upgraded to 28.0.11, 29.0.8 or 30.0.1 and Nextcloud Enterprise Server is upgraded to 25.0.13.13, 26.0.13.9, 2
Server is upgraded to 28.0.11, 29.0.8 or 30.0.1 and Nextcloud Enterprise Server is upgraded to 25.0.13.13, 26.0.13.9, 27.1.11.9, 28.0.11, 29.0.8 or 30.0.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-x9q3-c7f8-3rcg - https://github.com/nextcloud/server/pull/48359 - https://github.com/nextcloud/server/commit/c45ed55f959ff54f3ea23dd2ae1a5868a075c9fe - https://hackerone.com/reports/2554079
CVE ID: CVE-2024-52518 State: PUBLISHED Published: 2024-11-15T16:46:44.675Z Last Updated: 2024-11-15T17:31:41.474Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: nextcloud Products: security-advisories Problem Types: CWE-287 Description: Nextcloud Server is a self hosted personal cloud system. After an attacker got access to the session of a user or administrator, the attacker would be able to create, change or delete external storages without having to confirm the password. It is recommended that the Nextcloud Server is upgraded to 28.0.12, 29.0.9 or 30.0.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/nextcloud/secur
2, 29.0.9 or 30.0.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-vrhf-532w-99rg - https://github.com/nextcloud/server/pull/48373 - https://github.com/nextcloud/server/pull/48788 - https://github.com/nextcloud/server/pull/48992 - https://hackerone.com/reports/2602973
CVE ID: CVE-2024-52519 State: PUBLISHED Published: 2024-11-15T16:43:57.246Z Last Updated: 2024-11-15T16:58:55.845Z Severity: LOW (CVSS 2.7 CVSS:3.1/AV:P/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N) Vendors: nextcloud Products: security-advisories Problem Types: CWE-922 Description: Nextcloud Server is a self hosted personal cloud system. The OAuth2 client secrets were stored in a recoverable way, so that an attacker that got access to a backup of the database and the Nextcloud config file, would be able to decrypt them. It is recommended that the Nextcloud Server is upgraded to 28.0.10 or 29.0.7 and Nextcloud Enterprise Server is upgraded to 27.1.11.8, 28.0.10 or 29.0.7. Additional Analyst Notes: - CISA
or 29.0.7 and Nextcloud Enterprise Server is upgraded to 27.1.11.8, 28.0.10 or 29.0.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-fvpc-8hq6-jgq2 - https://github.com/nextcloud/server/pull/47635 - https://github.com/nextcloud/server/commit/09b8aea8f6783514bffe00df6abbf9fa542faac5
CVE ID: CVE-2024-52520 State: PUBLISHED Published: 2024-11-15T16:41:42.412Z Last Updated: 2024-11-15T17:01:01.172Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H) Vendors: nextcloud Products: security-advisories Problem Types: CWE-400 Description: Nextcloud Server is a self hosted personal cloud system. Due to a pre-flighted HEAD request, the link reference provider could be tricked into downloading bigger websites than intended, to find open-graph data. It is recommended that the Nextcloud Server is upgraded to 28.0.10 or 29.0.7 and Nextcloud Enterprise Server is upgraded to 27.1.11.8, 28.0.10 or 29.0.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References:
prise Server is upgraded to 27.1.11.8, 28.0.10 or 29.0.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-pxqf-cfxw-mqmj - https://github.com/nextcloud/server/pull/47627 - https://github.com/nextcloud/server/commit/873c42b0f1383d5b6f2b7a481e1d9620ed30f44a
CVE ID: CVE-2024-52521 State: PUBLISHED Published: 2024-11-15T16:38:49.174Z Last Updated: 2024-11-15T17:04:24.129Z Severity: LOW (CVSS 2.6 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: nextcloud Products: security-advisories Problem Types: CWE-328 Description: Nextcloud Server is a self hosted personal cloud system. MD5 hashes were used to check background jobs for their uniqueness. This increased the chances of a background job with arguments falsely being identified as already existing and not be queued for execution. By changing the Hash to SHA256 the probability was heavily decreased. It is recommended that the Nextcloud Server is upgraded to 28.0.10, 29.0.7 or 30.0.0. Additiona
y was heavily decreased. It is recommended that the Nextcloud Server is upgraded to 28.0.10, 29.0.7 or 30.0.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-2q6f-gjgj-7hp4 - https://github.com/nextcloud/server/pull/47769 - https://github.com/nextcloud/server/commit/a933ba1fdba77e7d8c6b8ff400e082cf853ea46d
CVE ID: CVE-2024-52522 State: PUBLISHED Published: 2024-11-15T17:15:43.357Z Last Updated: 2024-11-21T14:56:00.193Z Vendors: rclone Products: rclone Problem Types: CWE-59, CWE-61, CWE-281 Description: Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Insecure handling of symlinks with --links and --metadata in rclone while copying to local disk allows unprivileged users to indirectly modify ownership and permissions on symlink target files when a superuser or privileged process performs a copy. This vulnerability could enable privilege escalation and unauthorized access to critical system files, compromising system integrity, confide
uld enable privilege escalation and unauthorized access to critical system files, compromising system integrity, confidentiality, and availability. This vulnerability is fixed in 1.68.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/rclone/rclone/security/advisories/GHSA-hrxh-9w67-g4cv - https://github.com/rclone/rclone/commit/01ccf204f42b4f68541b16843292439090a2dcf0
CVE ID: CVE-2024-52523 State: PUBLISHED Published: 2024-11-15T16:35:39.424Z Last Updated: 2024-11-15T17:06:22.449Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:P/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N) Vendors: nextcloud Products: security-advisories Problem Types: CWE-200 Description: Nextcloud Server is a self hosted personal cloud system. After setting up a user or administrator defined external storage with fixed credentials, the API returns them and adds them into the frontend again, allowing to read them in plain text when an attacker already has access to an active session of a user. It is recommended that the Nextcloud Server is upgraded to 28.0.12, 29.0.9 or 30.0.2 and Nextcloud Enterprise Server
er. It is recommended that the Nextcloud Server is upgraded to 28.0.12, 29.0.9 or 30.0.2 and Nextcloud Enterprise Server is upgraded to 25.0.13.14, 26.0.13.10, 27.1.11.10, 28.0.12, 29.0.9 or 30.0.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-42w6-r45m-9w9j - https://github.com/nextcloud/server/pull/49009 - https://github.com/nextcloud/server/commit/8a13f284765bd4606984e7d925c32ae6e82b8a27
CVE ID: CVE-2024-52524 State: PUBLISHED Published: 2024-11-14T17:21:50.600Z Last Updated: 2024-11-21T14:56:20.478Z Vendors: Giskard-AI Products: giskard Problem Types: CWE-1333 Description: Giskard is an evaluation and testing framework for AI systems. A Remote Code Execution (ReDoS) vulnerability was discovered in Giskard component by the GitHub Security Lab team. When processing datasets with specific text patterns with Giskard detectors, this vulnerability could trigger exponential regex evaluation times, potentially leading to denial of service. Giskard versions prior to 2.15.5 are affected. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Giskard-AI/gi
o 2.15.5 are affected. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Giskard-AI/giskard/security/advisories/GHSA-pjwm-cr36-mwv3 - https://github.com/Giskard-AI/giskard/commit/48ce81f5c626171767188d6f0669498fb613b4d3
CVE ID: CVE-2024-52525 State: PUBLISHED Published: 2024-11-15T16:30:28.401Z Last Updated: 2024-11-15T17:10:50.412Z Severity: LOW (CVSS 1.8 CVSS:3.1/AV:P/AC:H/PR:H/UI:R/S:C/C:L/I:N/A:N) Vendors: nextcloud Products: security-advisories Problem Types: CWE-312 Description: Nextcloud Server is a self hosted personal cloud system. Under certain conditions the password of a user was stored unencrypted in the session data. The session data is encrypted before being saved in the session storage (Redis or disk), but it would allow a malicious process that gains access to the memory of the PHP process, to get access to the cleartext password of the user. It is recommended that the Nextcloud Server is u
f the PHP process, to get access to the cleartext password of the user. It is recommended that the Nextcloud Server is upgraded to 28.0.12, 29.0.9 or 30.0.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-w7v5-mgxm-v6gm - https://github.com/nextcloud/server/pull/48915 - https://github.com/nextcloud/server/commit/d25a0a2896a2a981939cacb8ee0d555feef22b3b
CVE ID: CVE-2024-52526 State: PUBLISHED Published: 2024-11-15T15:55:59.180Z Last Updated: 2024-11-15T16:39:15.274Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: librenms Products: librenms Problem Types: CWE-79 Description: LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the "Services" tab of the Device page allows authenticated users to inject arbitrary JavaScript through the "descr" parameter when adding a service to a device. This vulnerability could result in the execution of malicious code in the context of other users' sessions, potentially compromising their accounts an
t in the execution of malicious code in the context of other users' sessions, potentially compromising their accounts and enabling unauthorized actions. This vulnerability is fixed in 24.10.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/librenms/librenms/security/advisories/GHSA-8fh4-942r-jf2g - https://github.com/librenms/librenms/commit/30e522c29bbb1f9b72951025e7049a26c7e1d76e
CVE ID: CVE-2024-52528 State: PUBLISHED Published: 2024-11-15T16:21:56.073Z Last Updated: 2024-11-15T17:14:10.451Z Vendors: BudgetControl Products: Gateway Problem Types: CWE-285 Description: Budget Control Gateway acts as an entry point for incoming requests and routes them to the appropriate microservices for Budget Control. Budget Control Gateway does not properly validate auth tokens, which allows attackers to bypass intended restrictions. This vulnerability is fixed in 1.5.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/BudgetControl/Gateway/security/advisories/GHSA-jqx6-gm7f-vp7m
CVE ID: CVE-2024-52529 State: PUBLISHED Published: 2024-11-25T18:49:15.616Z Last Updated: 2024-11-26T14:28:59.941Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N) Vendors: cilium Products: cilium Problem Types: CWE-755 Description: Cilium is a networking, observability, and security solution with an eBPF-based dataplane. For users with the following configuration: 1. An allow policy that selects a Layer 3 destination and a port range `AND` 2. A Layer 7 allow policy that selects a specific port within the first policy's range the Layer 7 enforcement would not occur for the traffic selected by the Layer 7 policy. This issue only affects users who use Cilium's port rang
would not occur for the traffic selected by the Layer 7 policy. This issue only affects users who use Cilium's port range functionality, which was introduced in Cilium v1.16. This issue is patched in PR #35150. This issue affects Cilium v1.16 between v1.16.0 and v1.16.3 inclusive. This issue is patched in Cilium v1.16.4. Users are advised to upgrade. Users with network policies that match the pattern described above can work around the issue by rewriting any policies that use port ranges to individually specify the ports permitted for traffic. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/cilium/cilium/security/advisories/GHSA-xg58-75qf-9r67 - https://gi
SA ADP Vulnrichment: References: - https://github.com/cilium/cilium/security/advisories/GHSA-xg58-75qf-9r67 - https://github.com/cilium/cilium/pull/35150
CVE ID: CVE-2024-52530 State: PUBLISHED Published: 2024-11-11T00:00:00.000Z Last Updated: 2025-11-03T22:28:35.875Z Vendors: n/a Products: n/a Problem Types: n/a Description: GNOME libsoup before 3.6.0 allows HTTP request smuggling in some configurations because '\0' characters at the end of header names are ignored, i.e., a "Transfer-Encoding\0: chunked" header is treated the same as a "Transfer-Encoding: chunked" header. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.gnome.org/Teams/Releng/security/-/wikis/home - https://gitlab.gnome.org/GNOME/libsoup/-/issues/377 - https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/402
CVE ID: CVE-2024-52531 State: PUBLISHED Published: 2024-11-11T00:00:00.000Z Last Updated: 2025-11-03T22:28:37.340Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L) Vendors: GNOME Products: libsoup Problem Types: CWE-787 Description: GNOME libsoup before 3.6.1 allows a buffer overflow in applications that perform conversion to UTF-8 in soup_header_parse_param_list_strict. There is a plausible way to reach this remotely via soup_message_headers_get_content_type (e.g., an application may want to retrieve the content type of a request or response). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.gnome.org/Teams/Rele
ional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.gnome.org/Teams/Releng/security/-/wikis/home - https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/407 - https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/407#note_2316401 - https://offsec.almond.consulting/using-aflplusplus-on-bug-bounty-programs-an-example-with-gnome-libsoup.html
CVE ID: CVE-2024-52532 State: PUBLISHED Published: 2024-11-11T00:00:00.000Z Last Updated: 2025-11-03T22:28:38.799Z Vendors: n/a Products: n/a Problem Types: n/a Description: GNOME libsoup before 3.6.1 has an infinite loop, and memory consumption. during the reading of certain patterns of WebSocket data from clients. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.gnome.org/Teams/Releng/security/-/wikis/home - https://gitlab.gnome.org/GNOME/libsoup/-/issues/391 - https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/410
CVE ID: CVE-2024-52533 State: PUBLISHED Published: 2024-11-11T00:00:00 Last Updated: 2024-12-06T13:09:32.561Z Vendors: n/a Products: n/a Problem Types: n/a Description: gio/gsocks4aproxy.c in GNOME GLib before 2.82.1 has an off-by-one error and resultant buffer overflow because SOCKS4_CONN_MSG_LEN is not sufficient for a trailing '\0' character. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.gnome.org/Teams/Releng/security/-/wikis/home - https://gitlab.gnome.org/GNOME/glib/-/issues/3461 - https://gitlab.gnome.org/GNOME/glib/-/releases/2.82.1
CVE ID: CVE-2024-52534 State: PUBLISHED Published: 2024-12-25T16:04:17.253Z Last Updated: 2024-12-27T14:54:52.568Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: Dell Products: ECS Problem Types: CWE-294 Description: Dell ECS, version(s) prior to ECS 3.8.1.3, contain(s) an Authentication Bypass by Capture-replay vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Session theft. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000256642/dsa-2024-483-security-update-for-dell-ecs-multiple-vulnerabilities
CVE ID: CVE-2024-52535 State: PUBLISHED Published: 2024-12-25T14:41:36.996Z Last Updated: 2024-12-26T18:11:19.799Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) Vendors: Dell Products: SupportAssist for Home PCs, SupportAssist for Business PCs Problem Types: CWE-61 Description: Dell SupportAssist for Home PCs versions 4.6.1 and prior and Dell SupportAssist for Business PCs versions 4.5.0 and prior, contain a symbolic link (symlink) attack vulnerability in the software remediation component. A low-privileged authenticated user could potentially exploit this vulnerability, gaining privileges escalation, leading to arbitrary deletion of files and folders from the system
it this vulnerability, gaining privileges escalation, leading to arbitrary deletion of files and folders from the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000261086/dsa-2024-470-security-update-for-dell-supportassist-for-home-pcs-and-dell-supportassist-for-business-pcs-vulnerabilities
CVE ID: CVE-2024-52537 State: PUBLISHED Published: 2024-12-11T07:26:36.371Z Last Updated: 2024-12-11T15:33:08.517Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H) Vendors: Dell Products: Dell Client Platform BIOS Problem Types: CWE-61 Description: Dell Client Platform Firmware Update Utility contains an Improper Link Resolution vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000227591/dsa-2024-351
CVE ID: CVE-2024-52538 State: PUBLISHED Published: 2024-12-10T10:16:04.791Z Last Updated: 2025-08-04T18:40:30.859Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L) Vendors: Dell Products: Avamar Problem Types: CWE-89 Description: Dell Avamar, versions prior to 19.12 with patch 338905, excluding 19.10 and 19.10SP1 with patch 338869, contains an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Script injection. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000258
ection. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000258636/dsa-2024-489-security-update-for-dell-avamar-and-dell-avamar-virtual-edition-security-update-for-multiple-vulnerabilities
CVE ID: CVE-2024-52541 State: PUBLISHED Published: 2025-02-19T16:46:22.803Z Last Updated: 2025-02-19T17:08:48.094Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Dell Products: Dell Client Platform BIOS Problem Types: CWE-1390 Description: Dell Client Platform BIOS contains a Weak Authentication vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000258429/dsa-2025-021
CVE ID: CVE-2024-52542 State: PUBLISHED Published: 2024-12-17T11:33:54.239Z Last Updated: 2024-12-17T14:33:57.767Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: Dell Products: AppSync Problem Types: CWE-61 Description: Dell AppSync, version 4.6.0.x, contain a Symbolic Link (Symlink) Following vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to information tampering. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000261039/dsa-2024-496-security-update-for-dell-appsync-vulnerabilities
CVE ID: CVE-2024-52543 State: PUBLISHED Published: 2024-12-25T15:13:57.030Z Last Updated: 2024-12-27T14:55:23.197Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H) Vendors: Dell Products: NativeEdge Problem Types: CWE-378 Description: Dell NativeEdge, version(s) 2.1.0.0, contain(s) a Creation of Temporary File With Insecure Permissions vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Information disclosure. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000258904/dsa-2024-488-security-update-for-dell-nativeedge-multiple-vulnerabilities
CVE ID: CVE-2024-52544 State: PUBLISHED Published: 2024-12-03T17:18:17.023Z Last Updated: 2025-09-05T08:31:44.927Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Lorex Products: 2K Indoor Wi-Fi Security Camera Problem Types: CWE-121 Description: An unauthenticated attacker can trigger a stack based buffer overflow in the DP Service (TCP port 3500). This vulnerability has been resolved in firmware version 2.800.0000000.8.R.20241111. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/sfewer-r7/LorexExploit - https://www.rapid7.com/blog/post/2024/12/03/lorex-2k-indoor-wi-fi-security-camera-multiple-vulnerabilities-fixed/