Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.289766 - https://vuldb.com/?ctiid.289766 - https://vuldb.com/?submit.471109 - https://code-projects.org/
CVE ID: CVE-2024-13034 State: PUBLISHED Published: 2024-12-30T02:00:15.449Z Last Updated: 2024-12-30T14:25:54.392Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: code-projects Products: Chat System Problem Types: CWE-79, CWE-94 Description: A vulnerability, which was classified as problematic, was found in code-projects Chat System 1.0. This affects an unknown part of the file /admin/update_user.php. The manipulation of the argument name leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.289767 - https://v
d may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.289767 - https://vuldb.com/?ctiid.289767 - https://vuldb.com/?submit.471111 - https://code-projects.org/
CVE ID: CVE-2024-13035 State: PUBLISHED Published: 2024-12-30T02:31:04.945Z Last Updated: 2024-12-30T14:25:22.811Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: code-projects Products: Chat System Problem Types: CWE-89, CWE-74 Description: A vulnerability has been found in code-projects Chat System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/update_user.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.289768 - https://vuldb.com/?ct
d. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.289768 - https://vuldb.com/?ctiid.289768 - https://vuldb.com/?submit.471112 - https://code-projects.org/
CVE ID: CVE-2024-13036 State: PUBLISHED Published: 2024-12-30T03:00:14.514Z Last Updated: 2024-12-30T14:24:38.980Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: code-projects Products: Chat System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in code-projects Chat System 1.0 and classified as critical. This issue affects some unknown processing of the file /admin/update_room.php. The manipulation of the argument id/name/password leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.289769 - https://v
d may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.289769 - https://vuldb.com/?ctiid.289769 - https://vuldb.com/?submit.471113 - https://code-projects.org/
CVE ID: CVE-2024-13037 State: PUBLISHED Published: 2024-12-30T03:31:04.673Z Last Updated: 2024-12-30T14:23:57.826Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: 1000 Projects Products: Attendance Tracking Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in 1000 Projects Attendance Tracking Management System 1.0. It has been classified as critical. Affected is the function attendance_report of the file /admin/report.php. The manipulation of the argument course_id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichmen
remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.289770 - https://vuldb.com/?ctiid.289770 - https://vuldb.com/?submit.471674 - https://github.com/matias-a11y/cve/issues/2 - https://1000projects.org/
CVE ID: CVE-2024-13038 State: PUBLISHED Published: 2024-12-30T04:00:15.421Z Last Updated: 2024-12-30T16:34:39.218Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: CodeAstro Products: Simple Loan Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in CodeAstro Simple Loan Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /index.php of the component Login. The manipulation of the argument email leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: Refe
y. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.289771 - https://vuldb.com/?ctiid.289771 - https://vuldb.com/?submit.471675 - https://github.com/shaturo1337/POCs/blob/main/Blind%20SQL%20Injection%20in%20Simple%20Loan%20Management%20System.md - https://codeastro.com/
CVE ID: CVE-2024-13039 State: PUBLISHED Published: 2024-12-30T04:31:05.298Z Last Updated: 2024-12-30T16:28:41.530Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: code-projects Products: Simple Chat System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in code-projects Simple Chat System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /add_user.php. The manipulation of the argument name/email/password/number leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuld
n disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.289772 - https://vuldb.com/?ctiid.289772 - https://vuldb.com/?submit.471644 - https://github.com/Curious-L/-/issues/1 - https://code-projects.org/
CVE ID: CVE-2024-13040 State: PUBLISHED Published: 2024-12-31T01:35:20.576Z Last Updated: 2024-12-31T15:54:48.243Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Quanta Computer Products: QOCA aim Problem Types: CWE-639 Description: The QOCA aim from Quanta Computer has an Authorization Bypass Through User-Controlled Key vulnerability. By controlling the user ID parameter, remote attackers with regular privileges could access certain features as any user, modify any user's account information and privileges, leading to privilege escalation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-8336-aa03b-1.html -
Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-8336-aa03b-1.html - https://www.twcert.org.tw/en/cp-139-8337-7899f-2.html
CVE ID: CVE-2024-13041 State: PUBLISHED Published: 2025-01-09T06:33:13.241Z Last Updated: 2025-01-09T15:29:59.641Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-286 Description: An issue was discovered in GitLab CE/EE affecting all versions starting from 16.4 prior to 17.5.5, starting from 17.6 prior to 17.6.3, and starting from 17.7 prior to 17.7.1. When a user is created via the SAML provider, the external groups setting overrides the external provider configuration. As a result, the user may not be marked as external thereby giving those users access to internal projects or groups. Additional Analyst Notes: - C
ot be marked as external thereby giving those users access to internal projects or groups. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/479165 - https://about.gitlab.com/releases/2025/01/08/patch-release-gitlab-17-7-1-released/#instance-saml-does-not-respect-external_provider-configuration
CVE ID: CVE-2024-13042 State: PUBLISHED Published: 2024-12-30T21:00:15.420Z Last Updated: 2025-01-04T12:25:07.682Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Tsinghua Unigroup Products: Electronic Archives Management System Problem Types: CWE-200, CWE-284 Description: A vulnerability was found in Tsinghua Unigroup Electronic Archives Management System 3.2.210802(62532). It has been classified as problematic. Affected is the function download of the file /Searchnew/Subject/download.html. The manipulation of the argument path leads to information disclosure. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may
formation disclosure. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.289788 - https://vuldb.com/?ctiid.289788 - https://vuldb.com/?submit.472068 - https://github.com/BxYQ/zg_fileread - https://github.com/BxYQ/zg_fileread/blob/main/poc.py
CVE ID: CVE-2024-13043 State: PUBLISHED Published: 2024-12-30T20:12:46.300Z Last Updated: 2024-12-30T23:05:54.331Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Panda Security Products: Dome Problem Types: CWE-59 Description: Panda Security Dome Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Panda Security Dome. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Hotspot Shield. By creating a junction, an attacker can abuse the application
lity. The specific flaw exists within the Hotspot Shield. By creating a junction, an attacker can abuse the application to delete arbitrary files. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-23478. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-1727/
CVE ID: CVE-2024-13044 State: PUBLISHED Published: 2024-12-30T20:15:47.208Z Last Updated: 2024-12-30T23:05:38.421Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Ashlar-Vellum Products: Cobalt Problem Types: CWE-787 Description: Ashlar-Vellum Cobalt AR File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of AR files. The issue results from the lack of
e or open a malicious file. The specific flaw exists within the parsing of AR files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24870. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-1728/
CVE ID: CVE-2024-13045 State: PUBLISHED Published: 2024-12-30T20:15:52.759Z Last Updated: 2024-12-30T23:05:24.920Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Ashlar-Vellum Products: Cobalt Problem Types: CWE-121 Description: Ashlar-Vellum Cobalt AR File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of AR files. The issue results from the
ious page or open a malicious file. The specific flaw exists within the parsing of AR files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24848. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-1729/
CVE ID: CVE-2024-13046 State: PUBLISHED Published: 2024-12-30T20:15:57.048Z Last Updated: 2024-12-30T23:05:10.576Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Ashlar-Vellum Products: Cobalt Problem Types: CWE-787 Description: Ashlar-Vellum Cobalt CO File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of CO files. The issue results from the lack of
e or open a malicious file. The specific flaw exists within the parsing of CO files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24867. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-1730/
CVE ID: CVE-2024-13047 State: PUBLISHED Published: 2024-12-30T20:16:00.886Z Last Updated: 2024-12-30T23:04:50.456Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Ashlar-Vellum Products: Cobalt Problem Types: CWE-843 Description: Ashlar-Vellum Cobalt CO File Parsing Type Confusion Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of CO files. The issue results from the lack of prope
open a malicious file. The specific flaw exists within the parsing of CO files. The issue results from the lack of proper validation of user-supplied data, which can result in a type confusion condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24843. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-1731/
CVE ID: CVE-2024-13048 State: PUBLISHED Published: 2024-12-30T20:16:05.399Z Last Updated: 2024-12-30T23:04:26.755Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Ashlar-Vellum Products: Cobalt Problem Types: CWE-787 Description: Ashlar-Vellum Cobalt XE File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of XE files. The issue results from the lack of
e or open a malicious file. The specific flaw exists within the parsing of XE files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24844. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-1732/
CVE ID: CVE-2024-13049 State: PUBLISHED Published: 2024-12-30T20:16:09.642Z Last Updated: 2024-12-30T23:01:51.565Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Ashlar-Vellum Products: Cobalt Problem Types: CWE-843 Description: Ashlar-Vellum Cobalt XE File Parsing Type Confusion Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of XE files. The issue results from the lack of prope
open a malicious file. The specific flaw exists within the parsing of XE files. The issue results from the lack of proper validation of user-supplied data, which can result in a type confusion condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24847. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-1733/
CVE ID: CVE-2024-13050 State: PUBLISHED Published: 2024-12-30T20:16:14.569Z Last Updated: 2024-12-30T23:01:36.394Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Ashlar-Vellum Products: Graphite Problem Types: CWE-122 Description: Ashlar-Vellum Graphite VC6 File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Graphite. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of VC6 files. The issue results fr
malicious page or open a malicious file. The specific flaw exists within the parsing of VC6 files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24976. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-1734/
CVE ID: CVE-2024-13051 State: PUBLISHED Published: 2024-12-30T20:16:19.818Z Last Updated: 2024-12-30T23:01:24.150Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Ashlar-Vellum Products: Graphite Problem Types: CWE-122 Description: Ashlar-Vellum Graphite VC6 File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Graphite. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of VC6 files. The issue results fr
malicious page or open a malicious file. The specific flaw exists within the parsing of VC6 files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24977. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-1735/
CVE ID: CVE-2024-13052 State: PUBLISHED Published: 2025-01-27T06:00:09.475Z Last Updated: 2025-01-27T20:04:46.938Z Vendors: Unknown Products: Dental Optimizer Patient Generator App Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Dental Optimizer Patient Generator App WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/671d5eef-c496-4047-9d01-8ab8a94cdc72/
CVE ID: CVE-2024-13053 State: PUBLISHED Published: 2025-05-15T20:06:58.361Z Last Updated: 2025-05-20T19:29:28.715Z Vendors: Unknown Products: Form Maker by 10Web Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Form Maker by 10Web WordPress plugin before 1.15.33 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/1c667a70-8b38-4854-8969-2971f9c2fe79/
CVE ID: CVE-2024-13054 State: PUBLISHED Published: 2025-03-13T05:56:09.637Z Last Updated: 2025-03-14T14:36:19.463Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: GitLab Products: GitLab Problem Types: CWE-770 Description: An issue was discovered in GitLab CE/EE affecting all versions before 17.7.7, 17.8 prior to 17.8.5, and 17.9 prior to 17.9.2. where a denial of service vulnerability could allow an attacker to cause a system reboot under certain conditions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/511004 - https://hackerone.com/reports/2911928
CVE ID: CVE-2024-13055 State: PUBLISHED Published: 2025-01-27T06:00:09.889Z Last Updated: 2025-01-27T20:03:54.415Z Vendors: Unknown Products: Dyn Business Panel Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Dyn Business Panel WordPress plugin through 1.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/91178272-ed7e-412c-a187-e360a1313004/
CVE ID: CVE-2024-13056 State: PUBLISHED Published: 2025-01-27T06:00:10.321Z Last Updated: 2025-01-27T20:00:22.976Z Vendors: Unknown Products: Dyn Business Panel Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Dyn Business Panel WordPress plugin through 1.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/a6acb608-a23e-461d-af48-a6669a45594a/
CVE ID: CVE-2024-13057 State: PUBLISHED Published: 2025-01-27T06:00:10.625Z Last Updated: 2025-01-27T19:50:06.463Z Vendors: Unknown Products: Dyn Business Panel Problem Types: CWE-79 Cross-Site Scripting (XSS), CWE-352 Cross-Site Request Forgery (CSRF) Description: The Dyn Business Panel WordPress plugin through 1.0.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/6f869a3d-1ac1-4d31-8fe5-9b9795b15b5b/
CVE ID: CVE-2024-13058 State: PUBLISHED Published: 2024-12-30T22:08:31.690Z Last Updated: 2025-08-29T18:46:07.069Z Vendors: SoftIron Products: HyperCloud Problem Types: CWE-269, CWE-400, CWE-285 Description: An issue exists in SoftIron HyperCloud where authenticated, but non-admin users can create data pools, which could potentially impact the performance and availability of the backend software-defined storage subsystem. This issue only impacts SoftIron HyperCloud and related software products (such as VM Squared) software versions 2.3.0 to before 2.5.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://advisories.softiron.cloud/