Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-23169 State: PUBLISHED Published: 2024-11-15T00:00:00 Last Updated: 2024-11-15T18:54:35.164Z Vendors: n/a Products: n/a Problem Types: n/a Description: The web interface in RSA NetWitness 11.7.2.0 allows Cross-Site Scripting (XSS) via the Where textbox on the Reports screen during new rule creation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://community.netwitness.com/t5/netwitness-platform-online/tkb-p/netwitness-online-documentation - https://community.netwitness.com/t5/netwitness-platform-product/nw-2024-05-netwitness-platform-cross-site-scripting-xss/ta-p/719453
CVE ID: CVE-2024-23170 State: PUBLISHED Published: 2024-01-31T00:00:00.000Z Last Updated: 2025-11-04T18:23:42.058Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Mbed TLS 2.x before 2.28.7 and 3.x before 3.5.2. There was a timing side channel in RSA private operations. This side channel could be sufficient for a local attacker to recover the plaintext. It requires the attacker to send a large number of messages for decryption, as described in "Everlasting ROBOT: the Marvin Attack" by Hubert Kario. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtl
m Container: - CISA ADP Vulnrichment: References: - https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2024-01-1/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IIBPEYSVRK4IFLBSYJAWKH33YBNH5HR2/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GP5UU7Z6LJNBLBT4SC5WWS2HDNMTFZH5/
CVE ID: CVE-2024-23171 State: PUBLISHED Published: 2024-01-12T00:00:00.000Z Last Updated: 2025-06-20T16:45:30.614Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the CampaignEvents extension in MediaWiki before 1.35.14, 1.36.x through 1.39.x before 1.39.6, and 1.40.x before 1.40.2. The Special:EventDetails page allows XSS via the x-xss language setting for internationalization (i18n). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://phabricator.wikimedia.org/T348343 - https://gerrit.wikimedia.org/r/q/I70d71c409193e904684dfb706d424b0a815fa6f6
CVE ID: CVE-2024-23172 State: PUBLISHED Published: 2024-01-12T00:00:00.000Z Last Updated: 2025-06-04T15:18:54.208Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the CheckUser extension in MediaWiki before 1.35.14, 1.36.x through 1.39.x before 1.39.6, and 1.40.x before 1.40.2. XSS can occur via message definitions. e.g., in SpecialCheckUserLog. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://phabricator.wikimedia.org/T347708 - https://gerrit.wikimedia.org/r/c/mediawiki/extensions/CheckUser/+/989179
CVE ID: CVE-2024-23173 State: PUBLISHED Published: 2024-01-12T00:00:00.000Z Last Updated: 2025-06-03T14:06:50.171Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Cargo extension in MediaWiki before 1.35.14, 1.36.x through 1.39.x before 1.39.6, and 1.40.x before 1.40.2. The Special:Drilldown page allows XSS via artist, album, and position parameters because of applied filter values in drilldown/CargoAppliedFilter.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://phabricator.wikimedia.org/T348687 - https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/965214
CVE ID: CVE-2024-23174 State: PUBLISHED Published: 2024-01-12T00:00:00.000Z Last Updated: 2025-06-20T16:46:21.303Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the PageTriage extension in MediaWiki before 1.35.14, 1.36.x through 1.39.x before 1.39.6, and 1.40.x before 1.40.2. XSS can occur via the rev-deleted-user, pagetriage-tags-quickfilter-label, pagetriage-triage, pagetriage-filter-date-range-format-placeholder, pagetriage-filter-date-range-to, pagetriage-filter-date-range-from, pagetriage-filter-date-range-heading, pagetriage-filter-set-button, or pagetriage-filter-reset-button message. Additional Analyst Notes: - CVE Program Container: - CISA AD
lter-set-button, or pagetriage-filter-reset-button message. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://phabricator.wikimedia.org/T347704 - https://gerrit.wikimedia.org/r/c/mediawiki/extensions/PageTriage/+/989177
CVE ID: CVE-2024-23177 State: PUBLISHED Published: 2024-01-12T00:00:00.000Z Last Updated: 2025-06-03T14:06:45.120Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the WatchAnalytics extension in MediaWiki before 1.40.2. XSS can occur via the Special:PageStatistics page parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.wikimedia.org/hyperkitty/list/mediawiki-announce%40lists.wikimedia.org/message/TDBUBCCOQJUT4SCHJNPHKQNPBUUETY52/ - https://phabricator.wikimedia.org/T348979
CVE ID: CVE-2024-23178 State: PUBLISHED Published: 2024-01-12T00:00:00.000Z Last Updated: 2025-06-03T14:06:38.846Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Phonos extension in MediaWiki before 1.40.2. PhonosButton.js allows i18n-based XSS via the phonos-purge-needed-error message. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.wikimedia.org/hyperkitty/list/mediawiki-announce%40lists.wikimedia.org/message/TDBUBCCOQJUT4SCHJNPHKQNPBUUETY52/ - https://phabricator.wikimedia.org/T349312
CVE ID: CVE-2024-23179 State: PUBLISHED Published: 2024-01-12T00:00:00 Last Updated: 2024-09-25T20:34:20.981Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the GlobalBlocking extension in MediaWiki before 1.40.2. For a Special:GlobalBlock?uselang=x-xss URI, i18n-based XSS can occur via the parentheses message. This affects subtitle links in buildSubtitleLinks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.wikimedia.org/hyperkitty/list/mediawiki-announce%40lists.wikimedia.org/message/TDBUBCCOQJUT4SCHJNPHKQNPBUUETY52/ - https://phabricator.wikimedia.org/T347746
CVE ID: CVE-2024-23180 State: PUBLISHED Published: 2024-01-23T09:37:22.303Z Last Updated: 2025-06-04T15:09:52.447Z Vendors: appleple inc. Products: a-blog cms Ver.3.1.x series, a-blog cms Ver.3.0.x series, a-blog cms Ver.2.11.x series, a-blog cms Ver.2.10.x series, a-blog cms Problem Types: Improper input validation Description: Improper input validation vulnerability in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.7, Ver.3.0.x series versions prior to Ver.3.0.29, Ver.2.11.x series versions prior to Ver.2.11.58, Ver.2.10.x series versions prior to Ver.2.10.50, and Ver.2.9.0 and earlier allows a remote authenticated attacker to execute arbitrary code by uploading a specially crafted
Ver.2.9.0 and earlier allows a remote authenticated attacker to execute arbitrary code by uploading a specially crafted SVG file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://developer.a-blogcms.jp/blog/news/JVN-34565930.html - https://jvn.jp/en/jp/JVN34565930/
CVE ID: CVE-2024-23181 State: PUBLISHED Published: 2024-01-23T09:38:08.211Z Last Updated: 2025-06-20T19:10:49.356Z Vendors: appleple inc. Products: a-blog cms Ver.3.1.x series, a-blog cms Ver.3.0.x series, a-blog cms Ver.2.11.x series, a-blog cms Ver.2.10.x series, a-blog cms Problem Types: Cross-site scripting (XSS) Description: Cross-site scripting vulnerability in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.7, Ver.3.0.x series versions prior to Ver.3.0.29, Ver.2.11.x series versions prior to Ver.2.11.58, Ver.2.10.x series versions prior to Ver.2.10.50, and Ver.2.9.0 and earlier allows a remote unauthenticated attacker to execute an arbitrary script on the logged-in user's web br
2.9.0 and earlier allows a remote unauthenticated attacker to execute an arbitrary script on the logged-in user's web browser. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://developer.a-blogcms.jp/blog/news/JVN-34565930.html - https://jvn.jp/en/jp/JVN34565930/
CVE ID: CVE-2024-23182 State: PUBLISHED Published: 2024-01-23T09:38:58.906Z Last Updated: 2025-05-30T14:19:44.009Z Vendors: appleple inc. Products: a-blog cms Ver.3.1.x series, a-blog cms Ver.3.0.x series, a-blog cms Ver.2.11.x series, a-blog cms Ver.2.10.x series, a-blog cms Problem Types: Relative path traversal Description: Relative path traversal vulnerability in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.7, Ver.3.0.x series versions prior to Ver.3.0.29, Ver.2.11.x series versions prior to Ver.2.11.58, Ver.2.10.x series versions prior to Ver.2.10.50, and Ver.2.9.0 and earlier allows a remote authenticated attacker to delete arbitrary files on the server. Additional Analyst Not
2.9.0 and earlier allows a remote authenticated attacker to delete arbitrary files on the server. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://developer.a-blogcms.jp/blog/news/JVN-34565930.html - https://jvn.jp/en/jp/JVN34565930/
CVE ID: CVE-2024-23183 State: PUBLISHED Published: 2024-01-23T09:39:05.114Z Last Updated: 2025-06-20T19:11:32.290Z Vendors: appleple inc. Products: a-blog cms Ver.3.1.x series, a-blog cms Ver.3.0.x series, a-blog cms Ver.2.11.x series, a-blog cms Ver.2.10.x series, a-blog cms Problem Types: Cross-site scripting (XSS) Description: Cross-site scripting vulnerability in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.7, Ver.3.0.x series versions prior to Ver.3.0.29, Ver.2.11.x series versions prior to Ver.2.11.58, Ver.2.10.x series versions prior to Ver.2.10.50, and Ver.2.9.0 and earlier allows a remote authenticated attacker to execute an arbitrary script on the logged-in user's web brow
2.9.0 and earlier allows a remote authenticated attacker to execute an arbitrary script on the logged-in user's web browser. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://developer.a-blogcms.jp/blog/news/JVN-34565930.html - https://jvn.jp/en/jp/JVN34565930/
CVE ID: CVE-2024-23184 State: PUBLISHED Published: 2024-09-10T14:33:34.166Z Last Updated: 2025-11-04T16:11:12.830Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N) Vendors: Open-Xchange GmbH Products: OX Dovecot Pro Problem Types: CWE-770 Description: Having a large number of address headers (From, To, Cc, Bcc, etc.) becomes excessively CPU intensive. With 100k header lines CPU usage is already 12 seconds, and in a production environment we observed 500k header lines taking 18 minutes to parse. Since this can be triggered by external actors sending emails to a victim, this is a security issue. An external attacker can send specially crafted messages that consume target
ils to a victim, this is a security issue. An external attacker can send specially crafted messages that consume target system resources and cause outage. One can implement restrictions on address headers on MTA component preceding Dovecot. No publicly available exploits are known. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2024/oxdc-adv-2024-0002.json
CVE ID: CVE-2024-23185 State: PUBLISHED Published: 2024-09-10T14:38:50.523Z Last Updated: 2025-11-04T16:11:13.766Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Open-Xchange GmbH Products: OX Dovecot Pro Problem Types: CWE-770 Description: Very large headers can cause resource exhaustion when parsing message. The message-parser normally reads reasonably sized chunks of the message. However, when it feeds them to message-header-parser, it starts building up "full_value" buffer out of the smaller chunks. The full_value buffer has no size limit, so large headers can cause large memory usage. It doesn't matter whether it's a single long header line, or a single
t, so large headers can cause large memory usage. It doesn't matter whether it's a single long header line, or a single header split into multiple lines. This bug exists in all Dovecot versions. Incoming mails typically have some size limits set by MTA, so even largest possible header size may still fit into Dovecot's vsz_limit. So attackers probably can't DoS a victim user this way. A user could APPEND larger mails though, allowing them to DoS themselves (although maybe cause some memory issues for the backend in general). One can implement restrictions on headers on MTA component preceding Dovecot. No publicly available exploits are known. Additional Analyst Notes: - CVE Program Container:
omponent preceding Dovecot. No publicly available exploits are known. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2024/oxdc-adv-2024-0003.json
CVE ID: CVE-2024-23186 State: PUBLISHED Published: 2024-05-06T06:36:38.440Z Last Updated: 2025-02-13T17:33:46.948Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: Open-Xchange GmbH Products: OX App Suite Problem Types: CWE-79 Description: E-Mail containing malicious display-name information could trigger client-side script execution when using specific mobile devices. Attackers could perform malicious API requests or extract information from the users account. Please deploy the provided updates and patch releases. We now use safer methods of handling external content when embedding displayname information to the web interface. No publicly available exploits
f handling external content when embedding displayname information to the web interface. No publicly available exploits are known. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://documentation.open-xchange.com/appsuite/releases/8.22/ - https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2024/oxas-adv-2024-0002.json - http://seclists.org/fulldisclosure/2024/May/3
CVE ID: CVE-2024-23187 State: PUBLISHED Published: 2024-05-06T06:36:39.282Z Last Updated: 2025-02-13T17:33:47.505Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: Open-Xchange GmbH Products: OX App Suite Problem Types: CWE-79 Description: Content-ID based embedding of resources in E-Mails could be abused to trigger client-side script code when using the "show more" option. Attackers could perform malicious API requests or extract information from the users account. Exploiting the vulnerability requires user interaction. Please deploy the provided updates and patch releases. CID replacement has been hardened to omit invalid identifiers. No publicly available
ovided updates and patch releases. CID replacement has been hardened to omit invalid identifiers. No publicly available exploits are known. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://documentation.open-xchange.com/appsuite/releases/8.22/ - https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2024/oxas-adv-2024-0002.json - http://seclists.org/fulldisclosure/2024/May/3
CVE ID: CVE-2024-23188 State: PUBLISHED Published: 2024-05-06T06:36:40.100Z Last Updated: 2025-02-13T17:33:48.139Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: Open-Xchange GmbH Products: OX App Suite Problem Types: CWE-79 Description: Maliciously crafted E-Mail attachment names could be used to temporarily execute script code in the context of the users browser session. Common user interaction is required for the vulnerability to trigger. Attackers could perform malicious API requests or extract information from the users account. Please deploy the provided updates and patch releases. We now use safer methods of handling external content when embedding a
e deploy the provided updates and patch releases. We now use safer methods of handling external content when embedding attachment information to the web interface. No publicly available exploits are known. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://documentation.open-xchange.com/appsuite/releases/8.22/ - https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2024/oxas-adv-2024-0002.json - http://seclists.org/fulldisclosure/2024/May/3
CVE ID: CVE-2024-23189 State: PUBLISHED Published: 2024-04-08T08:09:11.505Z Last Updated: 2025-11-04T18:23:43.280Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: Open-Xchange GmbH Products: OX App Suite Problem Types: CWE-79 Description: Embedded content references at tasks could be used to temporarily execute script code in the context of the users browser session. To exploit this an attacker would require temporary access to the users account, access to another account within the same context or an successful social engineering attack to make users import external content. Attackers could perform malicious API requests or extract information from the user
make users import external content. Attackers could perform malicious API requests or extract information from the users account. Please deploy the provided updates and patch releases. Sanitization of user-generated content has been improved. No publicly available exploits are known. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://documentation.open-xchange.com/appsuite/releases/8.21/ - https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6268_7.10.6_2024-02-08.pdf - https://documentation.open-xchange.com/appsuite/releases/8.22/ - https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2024
open-xchange.com/appsuite/releases/8.22/ - https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2024/oxas-adv-2024-0001.json
CVE ID: CVE-2024-23190 State: PUBLISHED Published: 2024-04-08T08:09:12.210Z Last Updated: 2025-11-04T18:23:44.547Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Open-Xchange GmbH Products: OX App Suite Problem Types: CWE-79 Description: Upsell shop information of an account can be manipulated to execute script code in the context of the users browser session. To exploit this an attacker would require temporary access to a users account or an successful social engineering attack to lure users to maliciously configured accounts. Attackers could perform malicious API requests or extract information from the users account. Please deploy the provided updates an
ould perform malicious API requests or extract information from the users account. Please deploy the provided updates and patch releases. Sanitization of user-defined upsell content has been improved. No publicly available exploits are known. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://documentation.open-xchange.com/appsuite/releases/8.21/ - https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6268_7.10.6_2024-02-08.pdf - https://documentation.open-xchange.com/appsuite/releases/8.22/ - https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2024/oxas-adv-2024-0001.json
CVE ID: CVE-2024-23191 State: PUBLISHED Published: 2024-04-08T08:09:12.923Z Last Updated: 2025-11-04T18:23:45.931Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Open-Xchange GmbH Products: OX App Suite Problem Types: CWE-79 Description: Upsell advertisement information of an account can be manipulated to execute script code in the context of the users browser session. To exploit this an attacker would require temporary access to a users account or an successful social engineering attack to lure users to maliciously configured accounts. Attackers could perform malicious API requests or extract information from the users account. Please deploy the provided u
tackers could perform malicious API requests or extract information from the users account. Please deploy the provided updates and patch releases. Sanitization of user-defined upsell content has been improved. No publicly available exploits are known. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://documentation.open-xchange.com/appsuite/releases/8.21/ - https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6268_7.10.6_2024-02-08.pdf - https://documentation.open-xchange.com/appsuite/releases/8.22/ - https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2024/oxas-adv-2024-0001.json
CVE ID: CVE-2024-23192 State: PUBLISHED Published: 2024-04-08T08:09:13.629Z Last Updated: 2025-11-04T18:23:47.120Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Open-Xchange GmbH Products: OX App Suite Problem Types: CWE-79 Description: RSS feeds that contain malicious data- attributes could be abused to inject script code to a users browser session when reading compromised RSS feeds or successfully luring users to compromised accounts. Attackers could perform malicious API requests or extract information from the users account. Please deploy the provided updates and patch releases. Potentially malicious attributes now get removed from external RSS content
ploy the provided updates and patch releases. Potentially malicious attributes now get removed from external RSS content. No publicly available exploits are known. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://documentation.open-xchange.com/appsuite/releases/8.21/ - https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6268_7.10.6_2024-02-08.pdf - https://documentation.open-xchange.com/appsuite/releases/8.22/ - https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2024/oxas-adv-2024-0001.json
CVE ID: CVE-2024-23193 State: PUBLISHED Published: 2024-05-06T06:36:40.941Z Last Updated: 2025-02-13T17:33:48.706Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Open-Xchange GmbH Products: OX App Suite Problem Types: CWE-200 Description: E-Mails exported as PDF were stored in a cache that did not consider specific session information for the related user account. Users of the same service node could access other users E-Mails in case they were exported as PDF for a brief moment until caches were cleared. Successful exploitation requires good timing and modification of multiple request parameters. Please deploy the provided updates and patch releases. The c
ood timing and modification of multiple request parameters. Please deploy the provided updates and patch releases. The cache for PDF exports now takes user session information into consideration when performing authorization decisions. No publicly available exploits are known. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://documentation.open-xchange.com/appsuite/releases/8.22/ - https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2024/oxas-adv-2024-0002.json - http://seclists.org/fulldisclosure/2024/May/3
CVE ID: CVE-2024-23194 State: PUBLISHED Published: 2024-07-11T02:39:08.929Z Last Updated: 2024-08-01T22:59:31.449Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Gallagher Products: Command Centre Problem Types: CWE-117 Description: Improper output Neutralization for Logs (CWE-117) in the Command Centre API Diagnostics Endpoint could allow an attacker limited ability to modify Command Centre log files. This issue affects: Gallagher Command Centre v9.10 prior to vEL9.10.1268 (MR1). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://security.gallagher.com/Security-Advisories/CVE-2024-23194