Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-28980 State: PUBLISHED Published: 2024-12-13T14:20:15.834Z Last Updated: 2024-12-13T20:38:25.646Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: Dell Products: RecoverPoint for Virtual Machines Problem Types: CWE-327 Description: Dell RecoverPoint for VMs, version(s) 6.0.x contain(s) a Use of a Broken or Risky Cryptographic Algorithm vulnerability in the SSH. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Remote execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000259765/dsa-2024-429-security-update-for-dell-recoverpoi
hment: References: - https://www.dell.com/support/kbdoc/en-us/000259765/dsa-2024-429-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities
CVE ID: CVE-2024-28981 State: PUBLISHED Published: 2024-09-11T23:27:42.002Z Last Updated: 2024-09-12T13:18:16.563Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N) Vendors: Hitachi Vantara Products: Pentaho Data Integration & Analytics Problem Types: CWE-522 Description: Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.1.0.0 and 9.3.0.8, including 8.3.x, discloses database passwords when searching metadata injectable fields. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.pentaho.com/hc/en-us/articles/27569056997261--Resolved-Hitachi-Vantara-Pentaho-Data-Integration-Analytics-Insufficiently-Protected-Credentials-Ve
cles/27569056997261--Resolved-Hitachi-Vantara-Pentaho-Data-Integration-Analytics-Insufficiently-Protected-Credentials-Versions-before-10-1-0-0-including-9-3-x-and-8-3-x-impacted-CVE-2024-28981
CVE ID: CVE-2024-28982 State: PUBLISHED Published: 2024-06-26T22:37:01.285Z Last Updated: 2024-09-11T23:39:29.658Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H) Vendors: Hitachi Vantara Products: Pentaho Business Analytics Server Problem Types: CWE-776 Description: Hitachi Vantara Pentaho Business Analytics Server versions before 10.1.0.0 and 9.3.0.7, including 8.3.x do not correctly protect the ACL service endpoint of the Pentaho User Console against XML External Entity Reference. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.pentaho.com/hc/en-us/articles/27569195609869--Resolved-Hitachi-Vantara-Pentaho-Bus
tainer: References: - https://support.pentaho.com/hc/en-us/articles/27569195609869--Resolved-Hitachi-Vantara-Pentaho-Business-Analytics-Server-Improper-Restriction-of-XML-External-Entity-Reference-versions-before-10-1-0-0-and-9-3-0-7-including-8-3-x-Impacted-CVE-2024-28982
CVE ID: CVE-2024-28983 State: PUBLISHED Published: 2024-06-26T22:40:15.645Z Last Updated: 2024-09-11T23:40:00.607Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L) Vendors: Hitachi Vantara Products: Pentaho Business Analytics Server Problem Types: CWE-79 Description: Hitachi Vantara Pentaho Business Analytics Server prior to versions 10.1.0.0 and 9.3.0.7, including 8.3.x allow a malicious URL to inject content into the Analyzer plugin interface. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.pentaho.com/hc/en-us/articles/27569257123725-Hitachi-Vantara-Pentaho-Business-Analytics-Server-Improper-Neutralization-of-
ntaho.com/hc/en-us/articles/27569257123725-Hitachi-Vantara-Pentaho-Business-Analytics-Server-Improper-Neutralization-of-Input-During-Web-Page-Generation-Cross-site-Scripting-Versions-before-10-1-0-0-and-9-3-0-7-including-8-3-x-Impacted-CVE-2024-28983
CVE ID: CVE-2024-28984 State: PUBLISHED Published: 2024-06-26T22:41:57.450Z Last Updated: 2024-08-02T01:03:51.332Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L) Vendors: Hitachi Vantara Products: Pentaho Business Analytics Server Problem Types: CWE-79 Description: Hitachi Vantara Pentaho Business Analytics Server prior to versions 10.1.0.0 and 9.3.0.7, including 8.3.x allow a malicious URL to inject content into the Analyzer plugin interface. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.pentaho.com/hc/en-us/articles/27569319605901-Hitachi-Vantara-Pentaho-Business-Analytics-Server-Improper-Neutralization-of-
ntaho.com/hc/en-us/articles/27569319605901-Hitachi-Vantara-Pentaho-Business-Analytics-Server-Improper-Neutralization-of-Input-During-Web-Page-Generation-Cross-site-Scripting-Versions-before-10-1-0-0-and-9-3-0-7-including-8-3-x-Impacted-CVE-2024-28984
CVE ID: CVE-2024-28986 State: PUBLISHED Published: 2024-08-13T22:06:45.234Z Last Updated: 2025-10-21T22:55:47.324Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: SolarWinds Products: Web Help Desk Problem Types: CWE-502 Description: SolarWinds Web Help Desk was found to be susceptible to a Java Deserialization Remote Code Execution vulnerability that, if exploited, would allow an attacker to run commands on the host machine. While it was reported as an unauthenticated vulnerability, SolarWinds has been unable to reproduce it without authentication after thorough testing. However, out of an abundance of caution, we recommend all Web Help Desk customers app
entication after thorough testing. However, out of an abundance of caution, we recommend all Web Help Desk customers apply the patch, which is now available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.solarwinds.com/trust-center/security-advisories/CVE-2024-28986 - https://support.solarwinds.com/SuccessCenter/s/article/WHD-12-8-3-Hotfix-1
CVE ID: CVE-2024-28987 State: PUBLISHED Published: 2024-08-21T21:17:23.041Z Last Updated: 2025-10-21T22:55:46.764Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: SolarWinds Products: Web Help Desk Problem Types: CWE-798 Description: The SolarWinds Web Help Desk (WHD) software is affected by a hardcoded credential vulnerability, allowing remote unauthenticated user to access internal functionality and modify data. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.solarwinds.com/trust-center/security-advisories/cve-2024-28987 - https://support.solarwinds.com/SuccessCenter/s/article/SolarWinds-Web-Help-Desk
ter/security-advisories/cve-2024-28987 - https://support.solarwinds.com/SuccessCenter/s/article/SolarWinds-Web-Help-Desk-12-8-3-Hotfix-2
CVE ID: CVE-2024-28988 State: PUBLISHED Published: 2025-09-01T21:18:58.626Z Last Updated: 2025-09-03T03:55:24.519Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: SolarWinds Products: Web Help Desk Problem Types: CWE-502 Description: SolarWinds Web Help Desk was found to be susceptible to a Java Deserialization Remote Code Execution vulnerability that, if exploited, would allow an attacker to run commands on the host machine. This vulnerability was found by the ZDI team after researching a previous vulnerability and providing this report. The ZDI team was able to discover an unauthenticated attack during their research. We recommend all Web Help Desk custo
The ZDI team was able to discover an unauthenticated attack during their research. We recommend all Web Help Desk customers apply the patch, which is now available. We thank Trend Micro Zero Day Initiative (ZDI) for its ongoing partnership in coordinating with SolarWinds on responsible disclosure of this and other potential vulnerabilities. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.solarwinds.com/SuccessCenter/s/article/WHD-12-8-3-Hotfix-3 - https://www.solarwinds.com/trust-center/security-advisories/CVE-2024-28988
CVE ID: CVE-2024-28989 State: PUBLISHED Published: 2025-02-11T07:13:05.768Z Last Updated: 2025-02-11T15:27:11.512Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: SolarWinds Products: Web Help Desk Problem Types: CWE-321 Description: SolarWinds Web Help Desk was found to have a hardcoded cryptographic key that could allow the disclosure of sensitive information from the software. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.solarwinds.com/trust-center/security-advisories/CVE-2024-28989 - https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_12-8-5_release_notes.htm
CVE ID: CVE-2024-28990 State: PUBLISHED Published: 2024-09-12T13:16:35.586Z Last Updated: 2024-09-12T19:10:59.173Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: SolarWinds Products: Access Rights Manager Problem Types: CWE-798 Description: SolarWinds Access Rights Manager (ARM) was found to contain a hard-coded credential authentication bypass vulnerability. If exploited, this vulnerability would allow access to the RabbitMQ management console. We thank Trend Micro Zero Day Initiative (ZDI) for its ongoing partnership in coordinating with SolarWinds on responsible disclosure of this and other potential vulnerabilities. Additional Analyst Notes: - CISA ADP
SolarWinds on responsible disclosure of this and other potential vulnerabilities. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.solarwinds.com/trust-center/security-advisories/CVE-2024-28990 - https://documentation.solarwinds.com/en/success_center/arm/content/release_notes/arm_2024-3-1_release_notes.htm
CVE ID: CVE-2024-28991 State: PUBLISHED Published: 2024-09-12T13:17:30.721Z Last Updated: 2024-09-17T03:55:15.762Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: SolarWinds Products: Access Rights Manager Problem Types: CWE-502 Description: SolarWinds Access Rights Manager (ARM) was found to be susceptible to a remote code execution vulnerability. If exploited, this vulnerability would allow an authenticated user to abuse the service, resulting in remote code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.solarwinds.com/trust-center/security-advisories/CVE-2024-28991 - https://documentation.solarwinds.com/en/success_
://www.solarwinds.com/trust-center/security-advisories/CVE-2024-28991 - https://documentation.solarwinds.com/en/success_center/arm/content/release_notes/arm_2024-3-1_release_notes.htm
CVE ID: CVE-2024-28992 State: PUBLISHED Published: 2024-07-17T14:23:50.488Z Last Updated: 2024-08-02T01:03:51.617Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H) Vendors: SolarWinds Products: Access Rights Manager Problem Types: CWE-287 Description: The SolarWinds Access Rights Manager was susceptible to a Directory Traversal and Information Disclosure Vulnerability. This vulnerability allows an unauthenticated user to perform arbitrary file deletion and leak sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://documentation.solarwinds.com/en/success_center/arm/content/release_notes/arm_2024-3_release
ainer: References: - https://documentation.solarwinds.com/en/success_center/arm/content/release_notes/arm_2024-3_release_notes.htm
CVE ID: CVE-2024-28993 State: PUBLISHED Published: 2024-07-17T14:24:42.745Z Last Updated: 2024-08-02T01:03:51.579Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H) Vendors: SolarWinds Products: Access Rights Manager Problem Types: CWE-22 Description: The SolarWinds Access Rights Manager was susceptible to a Directory Traversal and Information Disclosure Vulnerability. This vulnerability allows an unauthenticated user to perform arbitrary file deletion and leak sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://documentation.solarwinds.com/en/success_center/arm/content/release_notes/arm_2024-3_release_
CVE ID: CVE-2024-28995 State: PUBLISHED Published: 2024-06-06T09:01:23.314Z Last Updated: 2025-10-21T23:05:16.763Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: SolarWinds Products: SolarWinds Serv-U Problem Types: CWE-22 Description: SolarWinds Serv-U was susceptible to a directory transversal vulnerability that would allow access to read sensitive files on the host machine. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.solarwinds.com/trust-center/security-advisories/CVE-2024-28995
CVE ID: CVE-2024-28996 State: PUBLISHED Published: 2024-06-04T14:49:53.075Z Last Updated: 2024-08-02T01:03:51.481Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: SolarWinds Products: SolarWinds Platform Problem Types: CWE-89 Description: The SolarWinds Platform was determined to be affected by a SWQL Injection Vulnerability. Attack complexity is high for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.solarwinds.com/trust-center/security-advisories/CVE-2024-28996 - https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2024-2_relea
ps://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2024-2_release_notes.htm
CVE ID: CVE-2024-28999 State: PUBLISHED Published: 2024-06-04T14:51:56.682Z Last Updated: 2024-08-02T01:03:51.426Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L) Vendors: SolarWinds Products: SolarWinds Platform Problem Types: CWE-362 Description: The SolarWinds Platform was determined to be affected by a Race Condition Vulnerability affecting the web console. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.solarwinds.com/trust-center/security-advisories/CVE-2024-28999 - https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2024-2_release_notes.htm
CVE ID: CVE-2024-29000 State: PUBLISHED Published: 2024-05-20T18:26:18.573Z Last Updated: 2024-08-02T01:03:51.521Z Severity: HIGH (CVSS 7.9 CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H) Vendors: SolarWinds Products: SolarWinds Platform Problem Types: CWE-79 Description: The SolarWinds Platform was determined to be affected by a reflected cross-site scripting vulnerability affecting the web console. A high-privileged user and user interaction is required to exploit this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2024-1-1_r
ttps://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2024-1-1_release_notes.htm - https://www.solarwinds.com/trust-center/security-advisories/CVE-2024-29000
CVE ID: CVE-2024-29001 State: PUBLISHED Published: 2024-04-18T09:06:41.437Z Last Updated: 2024-08-02T01:03:51.636Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L) Vendors: SolarWinds Products: SolarWinds Platform Problem Types: CWE-89 Description: A SolarWinds Platform SWQL Injection Vulnerability was identified in the user interface. This vulnerability requires authentication and user interaction to be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.solarwinds.com/trust-center/security-advisories/CVE-2024-29001 - https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/s
advisories/CVE-2024-29001 - https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2024-1-1_release_notes.htm
CVE ID: CVE-2024-29003 State: PUBLISHED Published: 2024-04-18T09:07:17.085Z Last Updated: 2024-08-02T01:03:51.506Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L) Vendors: SolarWinds Products: SolarWinds Platform Problem Types: CWE-79 Description: The SolarWinds Platform was susceptible to a XSS vulnerability that affects the maps section of the user interface. This vulnerability requires authentication and requires user interaction. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.solarwinds.com/trust-center/security-advisories/CVE-2024-29003 - https://documentation.solarwinds.com/en/success_center/orionplatform/con
ust-center/security-advisories/CVE-2024-29003 - https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2024-1-1_release_notes.htm
CVE ID: CVE-2024-29004 State: PUBLISHED Published: 2024-06-04T14:53:26.256Z Last Updated: 2024-08-02T01:03:51.367Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:L) Vendors: SolarWinds Products: SolarWinds Platform Problem Types: CWE-79 Description: The SolarWinds Platform was determined to be affected by a stored cross-site scripting vulnerability affecting the web console. A high-privileged user and user interaction is required to exploit this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.solarwinds.com/trust-center/security-advisories/CVE-2024-29004 - https://documentation.solarwinds.com/en/success
s://www.solarwinds.com/trust-center/security-advisories/CVE-2024-29004 - https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2024-2_release_notes.htm
CVE ID: CVE-2024-29006 State: PUBLISHED Published: 2024-04-04T07:48:54.101Z Last Updated: 2025-03-27T19:43:43.236Z Vendors: Apache Software Foundation Products: Apache CloudStack Problem Types: CWE-290 Description: By default the CloudStack management server honours the x-forwarded-for HTTP header and logs it as the source IP of an API request. This could lead to authentication bypass and other operational problems should an attacker decide to spoof their IP address this way. Users are recommended to upgrade to CloudStack version 4.18.1.1 or 4.19.0.1, which fixes this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lists.apache.org/thr
. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lists.apache.org/thread/82f46pv7mvh95ybto5hn8wlo6g8jhjvp
CVE ID: CVE-2024-29007 State: PUBLISHED Published: 2024-04-04T07:49:57.831Z Last Updated: 2024-11-12T18:07:54.494Z Vendors: Apache Software Foundation Products: Apache CloudStack Problem Types: CWE-918 Description: The CloudStack management server and secondary storage VM could be tricked into making requests to restricted or random resources by means of following 301 HTTP redirects presented by external servers when downloading templates or ISOs. Users are recommended to upgrade to version 4.18.1.1 or 4.19.0.1, which fixes this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lists.apache.org/thread/82f46pv7mvh95ybto5hn8wlo6g8jhjvp
CVE ID: CVE-2024-29008 State: PUBLISHED Published: 2024-04-04T07:51:05.423Z Last Updated: 2024-08-29T20:31:23.220Z Vendors: Apache Software Foundation Products: Apache CloudStack Problem Types: CWE-20 Description: A problem has been identified in the CloudStack additional VM configuration (extraconfig) feature which can be misused by anyone who has privilege to deploy a VM instance or configure settings of an already deployed VM instance, to configure additional VM configuration even when the feature is not explicitly enabled by the administrator. In a KVM based CloudStack environment, an attacker can exploit this issue to attach host devices such as storage disks, and PCI and USB devices su
environment, an attacker can exploit this issue to attach host devices such as storage disks, and PCI and USB devices such as network adapters and GPUs, in a regular VM instance that can be further exploited to gain access to the underlying network and storage infrastructure resources, and access any VM instance disks on the local storage. Users are advised to upgrade to version 4.18.1.1 or 4.19.0.1, which fixes this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/82f46pv7mvh95ybto5hn8wlo6g8jhjvp
CVE ID: CVE-2024-29009 State: PUBLISHED Published: 2024-03-25T04:14:37.123Z Last Updated: 2024-08-27T20:21:12.996Z Vendors: Ari Susanto Products: easy-popup-show Problem Types: Cross-site request forgery (CSRF) Description: Cross-site request forgery (CSRF) vulnerability in easy-popup-show all versions allows a remote unauthenticated attacker to hijack the authentication of the administrator and to perform unintended operations if the administrator views a malicious page while logged in. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/easy-popup-show/ - https://jvn.jp/en/jp/JVN86206017/
CVE ID: CVE-2024-29010 State: PUBLISHED Published: 2024-05-01T18:12:53.853Z Last Updated: 2024-08-02T01:03:51.475Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) Vendors: SonicWall Products: GMS Problem Types: CWE-611 Description: The XML document processed in the GMS ECM URL endpoint is vulnerable to XML external entity (XXE) injection, potentially resulting in the disclosure of sensitive information. This issue affects GMS: 9.3.4 and earlier versions. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0007
CVE ID: CVE-2024-29011 State: PUBLISHED Published: 2024-05-01T18:19:46.896Z Last Updated: 2024-08-02T01:03:51.499Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: SonicWall Products: GMS Problem Types: CWE-259 Description: Use of hard-coded password in the GMS ECM endpoint leading to authentication bypass vulnerability. This issue affects GMS: 9.3.4 and earlier versions. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0007
CVE ID: CVE-2024-29012 State: PUBLISHED Published: 2024-06-20T08:11:10.318Z Last Updated: 2025-03-25T16:30:24.601Z Vendors: SonicWall Products: SonicOS Problem Types: CWE-121 Description: Stack-based buffer overflow vulnerability in the SonicOS HTTP server allows an authenticated remote attacker to cause Denial of Service (DoS) via sscanf function. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0008
CVE ID: CVE-2024-29013 State: PUBLISHED Published: 2024-06-20T08:14:23.845Z Last Updated: 2025-03-25T16:29:38.467Z Vendors: SonicWall Products: SonicOS Problem Types: CWE-122 Description: Heap-based buffer overflow vulnerability in the SonicOS SSL-VPN allows an authenticated remote attacker to cause Denial of Service (DoS) via memcpy function. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0009
CVE ID: CVE-2024-29014 State: PUBLISHED Published: 2024-07-18T07:37:12.258Z Last Updated: 2024-11-27T04:55:16.232Z Vendors: SonicWall Products: NetExtender Problem Types: CWE-94 Description: Vulnerability in SonicWall SMA100 NetExtender Windows (32 and 64-bit) client 10.2.339 and earlier versions allows an attacker to arbitrary code execution when processing an EPC Client update. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0011