Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-27692 State: REJECTED Published: N/A Last Updated: 2024-03-01T16:38:31.172876 Description: No description available.
CVE ID: CVE-2024-27694 State: PUBLISHED Published: 2024-03-04T00:00:00 Last Updated: 2024-08-02T00:34:52.565Z Vendors: n/a Products: n/a Problem Types: n/a Description: FlyCms v1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the /system/share/ztree_category_edit. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/sms2056/cms/blob/main/1.md
CVE ID: CVE-2024-27698 State: REJECTED Published: N/A Last Updated: 2024-03-09T23:01:48.350124 Description: No description available.
CVE ID: CVE-2024-27703 State: PUBLISHED Published: 2024-03-13T00:00:00 Last Updated: 2024-08-27T18:32:24.776Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in Leantime 3.0.6 allows a remote attacker to execute arbitrary code via the to-do title parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/b-hermes/vulnerability-research/blob/main/CVE-2024-27703/README.md
CVE ID: CVE-2024-27705 State: PUBLISHED Published: 2024-04-03T00:00:00 Last Updated: 2024-08-28T18:48:45.470Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in Leantime v3.0.6 allows attackers to execute arbitrary code via upload of crafted PDF file to the files/browse endpoint. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/b-hermes/vulnerability-research/tree/main/CVE-2024-27705
CVE ID: CVE-2024-27706 State: PUBLISHED Published: 2024-04-03T00:00:00 Last Updated: 2024-11-01T19:33:46.408Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in Huly Platform v.0.6.202 allows attackers to execute arbitrary code via upload of crafted SVG file to issues. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/b-hermes/vulnerability-research/blob/main/CVE-2024-27706/README.md
CVE ID: CVE-2024-27707 State: PUBLISHED Published: 2024-03-07T00:00:00 Last Updated: 2024-08-06T13:49:53.976Z Vendors: n/a Products: n/a Problem Types: n/a Description: Server Side Request Forgery (SSRF) vulnerability in hcengineering Huly Platform v.0.6.202 allows attackers to run arbitrary code via upload of crafted SVG file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/b-hermes/vulnerability-research/tree/main/CVE-2024-27707
CVE ID: CVE-2024-27709 State: PUBLISHED Published: 2024-07-05T00:00:00 Last Updated: 2024-08-02T00:34:52.649Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection vulnerability in Eskooly Web Product v.3.0 allows a remote attacker to execute arbitrary code via the searchby parameter of the allstudents.php component and the id parameter of the requestmanager.php component. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://blog.be-hacktive.com/eskooly-cve/cve-2024-27709-sql-injection-in-eskooly-web-product-v.3.0
CVE ID: CVE-2024-27710 State: PUBLISHED Published: 2024-07-05T00:00:00 Last Updated: 2024-08-02T00:34:52.525Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Eskooly Free Online School management Software v.3.0 and before allows a remote attacker to escalate privileges via the authentication mechanism. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://blog.be-hacktive.com/eskooly-cve/eskooly-broken-authentication/cve-2024-27710-privilege-escalation-via-authentication-mechanism-in-eskooly-web-product-less-than-v3
CVE ID: CVE-2024-27711 State: PUBLISHED Published: 2024-07-05T00:00:00 Last Updated: 2024-08-21T13:43:21.495Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Eskooly Free Online School management Software v.3.0 and before allows a remote attacker to escalate privileges via the Sin-up process function in the account settings. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://blog.be-hacktive.com/eskooly-cve/eskooly-broken-authentication/cve-2024-27711-user-enumeration-via-sign-up-process-in-eskooly-web-product-less-than-v3.0
CVE ID: CVE-2024-27712 State: PUBLISHED Published: 2024-07-05T00:00:00.000Z Last Updated: 2025-03-13T19:49:24.977Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Eskooly Free Online School management Software v.3.0 and before allows a remote attacker to escalate privileges via the User Account Mangemnt component in the authentication mechanism. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://blog.be-hacktive.com/eskooly-cve/eskooly-broken-authentication/cve-2024-27712-user-enumeration-via-account-settings-in-eskooly-web-product-less-than-v3.0
CVE ID: CVE-2024-27713 State: PUBLISHED Published: 2024-07-05T00:00:00 Last Updated: 2024-08-02T00:34:52.648Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Eskooly Free Online School management Software v.3.0 and before allows a remote attacker to escalate privileges via the HTTP Response Header Settings component. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://blog.be-hacktive.com/eskooly-cve/cve-2024-27713-protection-mechanism-failure-in-eskooly-web-product-less-than-v3.0
CVE ID: CVE-2024-27715 State: PUBLISHED Published: 2024-07-05T00:00:00 Last Updated: 2024-08-02T00:34:52.479Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Eskooly Free Online School management Software v.3.0 and before allows a remote attacker to escalate privileges via a crafted request to the Password Change mechanism. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://blog.be-hacktive.com/eskooly-cve/cve-2024-27715-inadequate-password-update-verification-in-eskooly-web-product-less-than-v3.0
CVE ID: CVE-2024-27716 State: PUBLISHED Published: 2024-07-05T00:00:00 Last Updated: 2024-08-02T00:34:52.555Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in Eskooly Web Product v.3.0 and before allows a remote attacker to execute arbitrary code via the message sending and user input fields. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://blog.be-hacktive.com/eskooly-cve/cve-2024-27716-cross-site-scripting-xss-in-eskooly-web-product-less-than-v3.0
CVE ID: CVE-2024-27717 State: PUBLISHED Published: 2024-07-05T00:00:00 Last Updated: 2024-08-02T00:34:52.504Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Request Forgery vulnerability in Eskooly Free Online School Management Software v.3.0 and before allows a remote attacker to escalate privileges via the Token Handling component. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://blog.be-hacktive.com/eskooly-cve/cve-2024-27717-cross-site-request-forgery-csrf-in-eskooly-web-product-less-than-v3.0
CVE ID: CVE-2024-27718 State: PUBLISHED Published: 2024-03-04T00:00:00 Last Updated: 2024-08-27T19:24:13.572Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection vulnerability in Baizhuo Network Smart s200 Management Platform v.S200 allows a local attacker to obtain sensitive information and escalate privileges via the /importexport.php component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/tldjgggg/cve/blob/main/sql.md
CVE ID: CVE-2024-27719 State: PUBLISHED Published: 2024-03-28T00:00:00 Last Updated: 2024-08-27T18:26:40.329Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross site scripting (XSS) vulnerability in rems FAQ Management System v.1.0 allows a remote attacker to obtain sensitive information via a crafted payload to the Frequently Asked Question field in the Add FAQ function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wizlynxgroup.com/security-research-advisories/vuln/WLX-2024-002 - https://www.sourcecodester.com/php/17175/faq-management-system-using-php-and-mysql-source-code.html
CVE ID: CVE-2024-27728 State: PUBLISHED Published: 2024-08-15T00:00:00 Last Updated: 2024-08-20T13:27:50.755Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in Friendica v.2023.12 allows a remote attacker to obtain sensitive information via the text parameter of the babel debug feature. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://leo.oliver.nz/posts/2024/05/friendica-cve-disclosures/ - https://github.com/friendica/friendica/pull/13927
CVE ID: CVE-2024-27729 State: PUBLISHED Published: 2024-08-15T00:00:00 Last Updated: 2024-09-03T17:27:28.131Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in Friendica v.2023.12 allows a remote attacker to obtain sensitive information via the location parameter of the calendar event feature. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://leo.oliver.nz/posts/2024/05/friendica-cve-disclosures/ - https://github.com/friendica/friendica/pull/13927
CVE ID: CVE-2024-27730 State: PUBLISHED Published: 2024-08-15T00:00:00 Last Updated: 2024-08-16T15:21:20.368Z Vendors: n/a Products: n/a Problem Types: n/a Description: Insecure Permissions vulnerability in Friendica v.2023.12 allows a remote attacker to obtain sensitive information and execute arbitrary code via the cid parameter of the calendar event feature. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://leo.oliver.nz/posts/2024/05/friendica-cve-disclosures/ - https://github.com/friendica/friendica/pull/13927
CVE ID: CVE-2024-27731 State: PUBLISHED Published: 2024-08-15T00:00:00 Last Updated: 2024-08-16T17:19:12.192Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in Friendica v.2023.12 allows a remote attacker to obtain sensitive information via the lack of file type filtering in the file attachment parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://leo.oliver.nz/posts/2024/05/friendica-cve-disclosures/ - https://github.com/friendica/friendica/pull/13927
CVE ID: CVE-2024-27733 State: PUBLISHED Published: 2024-03-07T00:00:00 Last Updated: 2024-08-26T20:30:50.195Z Vendors: n/a Products: n/a Problem Types: n/a Description: File Upload vulnerability in Byzro Network Smart s42 Management Platform v.S42 allows a local attacker to execute arbitrary code via the useratte/userattestation.php component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Sadw11v/cve/blob/main/upload.md
CVE ID: CVE-2024-27734 State: PUBLISHED Published: 2024-03-01T00:00:00 Last Updated: 2024-08-29T14:12:47.975Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross Site Scripting vulnerability in CSZ CMS v.1.3.0 allows an attacker to execute arbitrary code via a crafted script to the Site Name fields of the Site Settings component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/sms2056/cms/blob/main/3.md
CVE ID: CVE-2024-27743 State: PUBLISHED Published: 2024-03-01T00:00:00.000Z Last Updated: 2025-03-24T17:22:26.807Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in Petrol Pump Mangement Software v.1.0 allows an attacker to execute arbitrary code via a crafted payload to the Address parameter in the add_invoices.php component. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/shubham-s-pandey/CVE_POC/blob/main/CVE-2024-27743.md
CVE ID: CVE-2024-27744 State: PUBLISHED Published: 2024-03-01T00:00:00 Last Updated: 2024-08-16T15:56:49.336Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in Petrol Pump Mangement Software v.1.0 allows an attacker to execute arbitrary code via a crafted payload to the image parameter in the profile.php component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/shubham-s-pandey/CVE_POC/blob/main/CVE-2024-27744.md
CVE ID: CVE-2024-27746 State: PUBLISHED Published: 2024-03-01T00:00:00 Last Updated: 2024-08-28T15:09:51.472Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection vulnerability in Petrol Pump Mangement Software v.1.0 allows an attacker to execute arbitrary code via a crafted payload to the email address parameter in the index.php component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/shubham-s-pandey/CVE_POC/blob/main/CVE-2024-27746.md
CVE ID: CVE-2024-27747 State: PUBLISHED Published: 2024-03-01T00:00:00 Last Updated: 2024-08-29T18:18:44.674Z Vendors: n/a Products: n/a Problem Types: n/a Description: File Upload vulnerability in Petrol Pump Mangement Software v.1.0 allows an attacker to execute arbitrary code via a crafted payload to the email Image parameter in the profile.php component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/shubham-s-pandey/CVE_POC/blob/main/CVE-2024-27747.md
CVE ID: CVE-2024-27752 State: PUBLISHED Published: 2024-04-19T00:00:00 Last Updated: 2024-08-02T00:34:52.523Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in CSZ CMS v.1.3.0 allows a remote attacker to execute arbitrary code via the Default Keyword field in the settings function. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/flyhha/cms/blob/main/1.md
CVE ID: CVE-2024-27756 State: PUBLISHED Published: 2024-03-15T00:00:00 Last Updated: 2024-08-27T13:59:45.258Z Vendors: n/a Products: n/a Problem Types: n/a Description: GLPI through 10.0.12 allows CSV injection by an attacker who is able to create an asset with a crafted title. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://medium.com/%40cristiansindile/formula-injection-in-glpi-cve-2024-27756-3649c7cca092
CVE ID: CVE-2024-27757 State: PUBLISHED Published: 2024-03-18T00:00:00 Last Updated: 2024-08-28T19:15:04.997Z Vendors: n/a Products: n/a Problem Types: n/a Description: flusity CMS through 2.45 allows tools/addons_model.php Gallery Name XSS. The reporter indicates that this product "ceased its development as of February 2024." Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/jubilianite/flusity-CMS/security/advisories/GHSA-5843-5m74-7fqh
CVE ID: CVE-2024-27758 State: PUBLISHED Published: 2024-03-12T00:00:00 Last Updated: 2024-08-02T00:34:52.544Z Vendors: n/a Products: n/a Problem Types: n/a Description: In RPyC before 6.0.0, when a server exposes a method that calls the attribute named __array__ for a client-provided netref (e.g., np.array(client_netref)), a remote attacker can craft a class that results in remote code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gist.github.com/renbou/957f70d27470982994f12a1d70153d09 - https://github.com/tomerfiliba-org/rpyc/security/advisories/GHSA-h5cg-53g7-gqjw
CVE ID: CVE-2024-27763 State: PUBLISHED Published: 2025-03-12T00:00:00.000Z Last Updated: 2025-03-12T17:55:06.628Z Vendors: n/a Products: n/a Problem Types: n/a Description: XPixelGroup BasicSR through 1.4.2 might locally allow code execution in contrived situations where "scontrol show hostname" is executed in the presence of a crafted SLURM_NODELIST environment variable. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/XPixelGroup/BasicSR/blob/master/basicsr/utils/dist_util.py#L44 - https://gist.github.com/aydinnyunus/40e1d8a3b529261ae654ff4891f1e192
CVE ID: CVE-2024-27764 State: PUBLISHED Published: 2024-03-05T00:00:00 Last Updated: 2024-08-29T16:55:35.581Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Jeewms v.3.7 and before allows a remote attacker to escalate privileges via the AuthInterceptor component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitee.com/erzhongxmu/JEEWMS/issues/I8YN90
CVE ID: CVE-2024-27765 State: PUBLISHED Published: 2024-03-05T00:00:00 Last Updated: 2024-08-08T15:13:09.855Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory Traversal vulnerability in Jeewms v.3.7 and before allows a remote attacker to obtain sensitive information via the cgformTemplateController component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitee.com/erzhongxmu/JEEWMS/issues/I8YN90
CVE ID: CVE-2024-27766 State: PUBLISHED Published: 2024-10-17T00:00:00 Last Updated: 2024-10-20T23:34:58.910368 Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in MariaDB v.11.1 allows a remote attacker to execute arbitrary code via the lib_mysqludf_sys.so function. NOTE: this is disputed by the MariaDB Foundation because no privilege boundary is crossed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Ant1sec-ops/CVE-2024-27766 - https://seclists.org/fulldisclosure/2012/Dec/39
CVE ID: CVE-2024-27767 State: PUBLISHED Published: 2024-03-18T13:13:36.868Z Last Updated: 2024-08-02T00:41:54.434Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Unitronics Products: Unistream Unilogic Problem Types: CWE-287 Description: CWE-287: Improper Authentication may allow Authentication Bypass Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0
CVE ID: CVE-2024-27768 State: PUBLISHED Published: 2024-03-18T13:19:49.735Z Last Updated: 2024-08-02T00:41:54.285Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Unitronics Products: Unistream Unilogic Problem Types: CWE-22 Description: Unitronics Unistream Unilogic – Versions prior to 1.35.227 - CWE-22: 'Path Traversal' may allow RCE Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0 - https://claroty.com/team82/blog/new-critical-vulnerabilities-in-unitronics-unistream-devices-uncovered
CVE ID: CVE-2024-27769 State: PUBLISHED Published: 2024-03-18T13:21:17.800Z Last Updated: 2025-04-10T20:24:59.561Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Unitronics Products: Unistream Unilogic Problem Types: CWE-200 Description: Unitronics Unistream Unilogic – Versions prior to 1.35.227 - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor may allow Taking Ownership Over Devices Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0 - https://claroty.com/team82/blog/new-critical-vulnerabilities-in-unitronics-unistream-d
s/cve_advisories_listing?skip=0 - https://claroty.com/team82/blog/new-critical-vulnerabilities-in-unitronics-unistream-devices-uncovered
CVE ID: CVE-2024-27770 State: PUBLISHED Published: 2024-03-18T13:23:31.838Z Last Updated: 2024-08-02T00:41:54.287Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Unitronics Products: Unistream Unilogic Problem Types: CWE-23 Description: Unitronics Unistream Unilogic – Versions prior to 1.35.227 - CWE-23: Relative Path Traversal Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0 - https://claroty.com/team82/blog/new-critical-vulnerabilities-in-unitronics-unistream-devices-uncovered
CVE ID: CVE-2024-27771 State: PUBLISHED Published: 2024-03-18T13:27:39.449Z Last Updated: 2024-08-02T00:41:54.438Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Unitronics Products: Unistream Unilogic Problem Types: CWE-22 Description: Unitronics Unistream Unilogic – Versions prior to 1.35.227 - CWE-22: 'Path Traversal' may allow RCE Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0 - https://claroty.com/team82/blog/new-critical-vulnerabilities-in-unitronics-unistream-devices-uncovered
CVE ID: CVE-2024-27772 State: PUBLISHED Published: 2024-03-18T13:28:35.731Z Last Updated: 2024-08-02T00:41:54.441Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Unitronics Products: Unistream Unilogic Problem Types: CWE-78 Description: Unitronics Unistream Unilogic – Versions prior to 1.35.227 - CWE-78: 'OS Command Injection' may allow RCE Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0 - https://claroty.com/team82/blog/new-critical-vulnerabilities-in-unitronics-unistream-devices-uncovered
CVE ID: CVE-2024-27773 State: PUBLISHED Published: 2024-03-18T13:32:46.698Z Last Updated: 2024-08-02T00:41:54.422Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Unitronics Products: Unistream Unilogic Problem Types: CWE-348 Description: Unitronics Unistream Unilogic – Versions prior to 1.35.227 - CWE-348: Use of Less Trusted Source may allow RCE Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0 - https://claroty.com/team82/blog/new-critical-vulnerabilities-in-unitronics-unistream-devices-uncovered
CVE ID: CVE-2024-27774 State: PUBLISHED Published: 2024-03-18T13:34:31.538Z Last Updated: 2024-08-02T00:41:54.444Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Unitronics Products: Unistream Unilogic Problem Types: CWE-259 Description: Unitronics Unistream Unilogic – Versions prior to 1.35.227 - CWE-259: Use of Hard-coded Password may allow disclosing Sensitive Information Embedded inside Device's Firmware Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0 - https://claroty.com/team82/blog/new-critical-vulnerabilities-in-unitronics-unistr
ectors/cve_advisories_listing?skip=0 - https://claroty.com/team82/blog/new-critical-vulnerabilities-in-unitronics-unistream-devices-uncovered
CVE ID: CVE-2024-27775 State: PUBLISHED Published: 2024-03-28T12:19:53.385Z Last Updated: 2024-08-02T00:41:54.967Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: SysAid Products: SysAid Problem Types: CWE-918 Description: SysAid before version 23.2.14 b18 - CWE-918: Server-Side Request Forgery (SSRF) may allow exposing the local OS user's NTLMv2 hash Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.gov.il/en/Departments/faq/cve_advisories
CVE ID: CVE-2024-27776 State: PUBLISHED Published: 2024-06-02T13:13:03.786Z Last Updated: 2024-08-02T00:41:54.420Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: MileSight Products: DeviceHub Problem Types: CWE-22 Description: MileSight DeviceHub - CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') may allow Unauthenticated RCE Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.gov.il/en/Departments/faq/cve_advisories