Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-52017 State: PUBLISHED Published: 2024-11-05T00:00:00 Last Updated: 2024-11-05T16:20:29.452Z Vendors: n/a Products: n/a Problem Types: n/a Description: Netgear XR300 v1.0.3.78 was discovered to contain a stack overflow via the passphrase parameter at bridge_wireless_main.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.netgear.com/about/security/ - https://github.com/wudipjq/my_vuln/blob/main/Netgear5/vuln_54/54.md
CVE ID: CVE-2024-52018 State: PUBLISHED Published: 2024-11-05T00:00:00 Last Updated: 2024-11-05T16:19:46.135Z Vendors: n/a Products: n/a Problem Types: n/a Description: Netgear XR300 v1.0.3.78 was discovered to contain a command injection vulnerability in the system_name parameter at genie_dyn.cgi. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.netgear.com/about/security/ - https://github.com/wudipjq/my_vuln/blob/main/Netgear5/vuln_53/53.md
CVE ID: CVE-2024-52019 State: PUBLISHED Published: 2024-11-05T00:00:00 Last Updated: 2024-11-05T16:19:09.591Z Vendors: n/a Products: n/a Problem Types: n/a Description: Netgear R8500 v1.0.2.160 was discovered to contain a command injection vulnerability in the wan_gateway parameter at genie_fix2.cgi. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.netgear.com/about/security/ - https://github.com/wudipjq/my_vuln/blob/main/Netgear4/vuln_47/47.md
CVE ID: CVE-2024-52020 State: PUBLISHED Published: 2024-11-05T00:00:00 Last Updated: 2024-11-05T15:30:27.352Z Vendors: n/a Products: n/a Problem Types: n/a Description: Netgear R8500 v1.0.2.160 was discovered to contain a command injection vulnerability in the wan_gateway parameter at wiz_fix2.cgi. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.netgear.com/about/security/ - https://github.com/wudipjq/my_vuln/blob/main/Netgear4/vuln_47/47.md
CVE ID: CVE-2024-52021 State: PUBLISHED Published: 2024-11-05T00:00:00 Last Updated: 2024-11-05T15:29:39.792Z Vendors: n/a Products: n/a Problem Types: n/a Description: Netgear R8500 v1.0.2.160 was discovered to contain a command injection vulnerability in the wan_gateway parameter at bsw_fix.cgi. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.netgear.com/about/security/ - https://github.com/wudipjq/my_vuln/blob/main/Netgear4/vuln_47/47.md
CVE ID: CVE-2024-52022 State: PUBLISHED Published: 2024-11-05T00:00:00 Last Updated: 2024-11-05T15:29:56.466Z Vendors: n/a Products: n/a Problem Types: n/a Description: Netgear R8500 v1.0.2.160, XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 were discovered to contain a command injection vulnerability in the component wlg_adv.cgi via the apmode_gateway parameter. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.netgear.com/about/security/ - https://github.com/wudipjq/my_vuln/blob/main/Netgear4/vuln_48/48.md
CVE ID: CVE-2024-52023 State: PUBLISHED Published: 2024-11-05T00:00:00 Last Updated: 2024-11-05T15:23:34.374Z Vendors: n/a Products: n/a Problem Types: n/a Description: Netgear XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 was discovered to contain a stack overflow via the pppoe_localip parameter at pppoe2.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.netgear.com/about/security/ - https://github.com/wudipjq/my_vuln/blob/main/Netgear5/vuln_52/52.md
CVE ID: CVE-2024-52024 State: PUBLISHED Published: 2024-11-05T00:00:00 Last Updated: 2024-11-05T15:23:22.077Z Vendors: n/a Products: n/a Problem Types: n/a Description: Netgear XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 was discovered to contain a stack overflow via the pppoe_localip parameter at wizpppoe.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.netgear.com/about/security/ - https://github.com/wudipjq/my_vuln/blob/main/Netgear5/vuln_52/52.md
CVE ID: CVE-2024-52025 State: PUBLISHED Published: 2024-11-05T00:00:00 Last Updated: 2024-11-05T15:22:58.324Z Vendors: n/a Products: n/a Problem Types: n/a Description: Netgear XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 was discovered to contain a stack overflow via the pppoe_localip parameter at geniepppoe.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.netgear.com/about/security/ - https://github.com/wudipjq/my_vuln/blob/main/Netgear5/vuln_52/52.md
CVE ID: CVE-2024-52026 State: PUBLISHED Published: 2024-11-05T00:00:00 Last Updated: 2024-11-05T15:21:54.109Z Vendors: n/a Products: n/a Problem Types: n/a Description: Netgear XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 was discovered to contain a stack overflow via the pppoe_localip parameter at bsw_pppoe.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.netgear.com/about/security/ - https://github.com/wudipjq/my_vuln/blob/main/Netgear5/vuln_52/52.md
CVE ID: CVE-2024-52028 State: PUBLISHED Published: 2024-11-05T00:00:00 Last Updated: 2024-11-05T15:17:31.090Z Vendors: n/a Products: n/a Problem Types: n/a Description: Netgear R7000P v1.3.3.154 was discovered to contain a stack overflow via the pptp_user_netmask parameter at wiz_pptp.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.netgear.com/about/security/ - https://github.com/wudipjq/my_vuln/blob/main/Netgear6/vuln_60/60.md
CVE ID: CVE-2024-52029 State: PUBLISHED Published: 2024-11-05T00:00:00 Last Updated: 2024-11-05T15:16:03.204Z Vendors: n/a Products: n/a Problem Types: n/a Description: Netgear R7000P v1.3.3.154 was discovered to contain a stack overflow via the pptp_user_netmask parameter at genie_pptp.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.netgear.com/about/security/ - https://github.com/wudipjq/my_vuln/blob/main/Netgear6/vuln_60/60.md
CVE ID: CVE-2024-52030 State: PUBLISHED Published: 2024-11-05T00:00:00 Last Updated: 2024-11-05T15:16:47.657Z Vendors: n/a Products: n/a Problem Types: n/a Description: Netgear R7000P v1.3.3.154 was discovered to contain a stack overflow via the pptp_user_netmask parameter at ru_wan_flow.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.netgear.com/about/security/ - https://github.com/wudipjq/my_vuln/blob/main/Netgear6/vuln_60/60.md
CVE ID: CVE-2024-52032 State: PUBLISHED Published: 2024-11-09T17:19:35.639Z Last Updated: 2024-11-12T14:52:07.690Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Mattermost Products: Mattermost Problem Types: CWE-200 Description: Mattermost versions 10.0.x <= 10.0.0 and 9.11.x <= 9.11.2 fail to properly query ElasticSearch when searching for the channel name in channel switcher which allows an attacker to get private channels names of channels that they are not a member of, when Elasticsearch v8 was enabled. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2024-52033 State: PUBLISHED Published: 2024-11-20T07:29:44.727Z Last Updated: 2024-11-20T15:05:53.174Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Rakuten Mobile, Inc. Products: Rakuten Turbo 5G Problem Types: CWE-497 Description: Exposure of sensitive system information to an unauthorized control sphere issue exists in Rakuten Turbo 5G firmware version V1.3.18 and earlier. If this vulnerability is exploited, a remote unauthenticated attacker may obtain information of the other devices connected through the Wi-Fi. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://network.mobile.rakuten.co.jp/internet/turbo/information/n
Analyst Notes: - CISA ADP Vulnrichment: References: - https://network.mobile.rakuten.co.jp/internet/turbo/information/news/3184/ - https://jvn.jp/en/vu/JVNVU90667116/
CVE ID: CVE-2024-52034 State: PUBLISHED Published: 2024-11-22T22:15:57.162Z Last Updated: 2024-11-25T19:02:53.753Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: mySCADA Products: myPRO Manager, myPRO Runtime Problem Types: CWE-78 Description: An OS Command Injection vulnerability exists within myPRO Manager. A parameter within a command can be exploited by an unauthenticated remote attacker to inject arbitrary operating system commands. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-326-07
CVE ID: CVE-2024-52035 State: PUBLISHED Published: 2025-06-02T15:00:17.160Z Last Updated: 2025-11-03T19:31:58.018Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: catdoc Products: catdoc Problem Types: CWE-190 Description: An integer overflow vulnerability exists in the OLE Document File Allocation Table Parser functionality of catdoc 0.95. A specially crafted malformed file can lead to heap-based memory corruption. An attacker can provide a malicious file to trigger this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2024-2131
CVE ID: CVE-2024-52043 State: PUBLISHED Published: 2024-11-06T07:51:17.483Z Last Updated: 2024-11-06T15:43:32.903Z Vendors: HumHub GmbH & Co. KG Products: HumHub Problem Types: CWE-209 Description: Generation of Error Message Containing Sensitive Information in HumHub GmbH & Co. KG - HumHub on Linux allows: Excavation (user enumeration).This issue affects all released HumHub versions: through 1.16.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.vulsec.org/advisories - https://github.com/advisories/GHSA-3q4w-rf2j-fx5x - https://https://github.com/humhub/humhub
CVE ID: CVE-2024-52046 State: PUBLISHED Published: 2024-12-25T10:06:23.887Z Last Updated: 2025-08-02T03:55:42.727Z Vendors: Apache Software Foundation Products: Apache MINA Problem Types: CWE-502 Description: The ObjectSerializationDecoder in Apache MINA uses Java’s native deserialization protocol to process incoming serialized data but lacks the necessary security checks and defenses. This vulnerability allows attackers to exploit the deserialization process by sending specially crafted malicious serialized data, potentially leading to remote code execution (RCE) attacks. This issue affects MINA core versions 2.0.X, 2.1.X and 2.2.X, and will be fixed by the releases 2.0.27, 2.1.10 and 2.2.4
This issue affects MINA core versions 2.0.X, 2.1.X and 2.2.X, and will be fixed by the releases 2.0.27, 2.1.10 and 2.2.4. It's also important to note that an application using MINA core library will only be affected if the IoBuffer#getObject() method is called, and this specific method is potentially called when adding a ProtocolCodecFilter instance using the ObjectSerializationCodecFactory class in the filter chain. If your application is specifically using those classes, you have to upgrade to the latest version of MINA core library. Upgrading will not be enough: you also need to explicitly allow the classes the decoder will accept in the ObjectSerializationDecoder instance, using one of t
need to explicitly allow the classes the decoder will accept in the ObjectSerializationDecoder instance, using one of the three new methods: /** * Accept class names where the supplied ClassNameMatcher matches for * deserialization, unless they are otherwise rejected. * * @param classNameMatcher the matcher to use */ public void accept(ClassNameMatcher classNameMatcher) /** * Accept class names that match the supplied pattern for * deserialization, unless they are otherwise rejected. * * @param pattern standard Java regexp */ public void accept(Pattern pattern) /** * Accept the wildcard specified classes for deserialization, * unless they are otherwise rejected. * * @param patterns Wildcard
t the wildcard specified classes for deserialization, * unless they are otherwise rejected. * * @param patterns Wildcard file name patterns as defined by * {@link org.apache.commons.io.FilenameUtils#wildcardMatch(String, String) FilenameUtils.wildcardMatch} */ public void accept(String... patterns) By default, the decoder will reject *all* classes that will be present in the incoming data. Note: The FtpServer, SSHd and Vysper sub-project are not affected by this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/4wxktgjpggdbto15d515wdctohb0qmv8
CVE ID: CVE-2024-52047 State: PUBLISHED Published: 2024-12-31T16:09:28.937Z Last Updated: 2025-01-02T19:23:08.104Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Trend Micro, Inc. Products: Trend Micro Apex One, Trend Micro Apex One as a Service Description: A widget local file inclusion vulnerability in Trend Micro Apex One could allow a remote attacker to execute arbitrary code on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://success.trendmicro.com/en-US/solution
rability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://success.trendmicro.com/en-US/solution/KA-0016669
CVE ID: CVE-2024-52048 State: PUBLISHED Published: 2024-12-31T16:11:41.737Z Last Updated: 2024-12-31T19:27:31.262Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Trend Micro, Inc. Products: Trend Micro Apex One, Trend Micro Apex One as a Service Problem Types: CWE-266 Description: A LogServer link following vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected installations. This vulnerability is similar to, but not identical to CVE-2024-52049. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. Additional Analyst Note
lity to execute low-privileged code on the target system in order to exploit this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://success.trendmicro.com/en-US/solution/KA-0018217
CVE ID: CVE-2024-52049 State: PUBLISHED Published: 2024-12-31T16:13:12.794Z Last Updated: 2024-12-31T19:24:27.242Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Trend Micro, Inc. Products: Trend Micro Apex One, Trend Micro Apex One as a Service Problem Types: CWE-266 Description: A LogServer link following vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected installations. This vulnerability is similar to, but not identical to CVE-2024-52048. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. Additional Analyst Note
CVE ID: CVE-2024-52050 State: PUBLISHED Published: 2024-12-31T16:13:49.837Z Last Updated: 2024-12-31T19:23:30.431Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Trend Micro, Inc. Products: Trend Micro Apex One, Trend Micro Apex One as a Service Problem Types: CWE-59 Description: A LogServer arbitrary file creation vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://success.trend
er to exploit this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://success.trendmicro.com/en-US/solution/KA-0018217
CVE ID: CVE-2024-52051 State: PUBLISHED Published: 2024-12-10T13:53:57.576Z Last Updated: 2025-08-12T11:16:46.791Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: SIMATIC S7-PLCSIM V17, SIMATIC S7-PLCSIM V18, SIMATIC STEP 7 Safety V17, SIMATIC STEP 7 Safety V18, SIMATIC STEP 7 Safety V19, SIMATIC STEP 7 V17, SIMATIC STEP 7 V18, SIMATIC STEP 7 V19, SIMATIC WinCC Unified PC Runtime V18, SIMATIC WinCC Unified PC Runtime V19, SIMATIC WinCC Unified V17, SIMATIC WinCC Unified V18, SIMATIC WinCC Unified V19, SIMATIC WinCC V17, SIMATIC WinCC V18, SIMATIC WinCC V19, SIMOCODE ES V17, SIMOCODE ES V18, SIMOCODE ES V19, SIMOTION SCOUT TIA V5
inCC V17, SIMATIC WinCC V18, SIMATIC WinCC V19, SIMOCODE ES V17, SIMOCODE ES V18, SIMOCODE ES V19, SIMOTION SCOUT TIA V5.4, SIMOTION SCOUT TIA V5.5, SIMOTION SCOUT TIA V5.6, SINAMICS Startdrive V17, SINAMICS Startdrive V18, SINAMICS Startdrive V19, SIRIUS Safety ES V17 (TIA Portal), SIRIUS Safety ES V18 (TIA Portal), SIRIUS Safety ES V19 (TIA Portal), SIRIUS Soft Starter ES V17 (TIA Portal), SIRIUS Soft Starter ES V18 (TIA Portal), SIRIUS Soft Starter ES V19 (TIA Portal), TIA Portal Cloud V17, TIA Portal Cloud V18, TIA Portal Cloud V19 Problem Types: CWE-20 Description: A vulnerability has been identified in SIMATIC S7-PLCSIM V17 (All versions), SIMATIC S7-PLCSIM V18 (All versions), SIMATIC
ulnerability has been identified in SIMATIC S7-PLCSIM V17 (All versions), SIMATIC S7-PLCSIM V18 (All versions), SIMATIC STEP 7 Safety V17 (All versions), SIMATIC STEP 7 Safety V18 (All versions), SIMATIC STEP 7 Safety V19 (All versions < V19 Update 4), SIMATIC STEP 7 V17 (All versions), SIMATIC STEP 7 V18 (All versions), SIMATIC STEP 7 V19 (All versions < V19 Update 4), SIMATIC WinCC Unified PC Runtime V18 (All versions), SIMATIC WinCC Unified PC Runtime V19 (All versions < V19 Update 4), SIMATIC WinCC Unified V17 (All versions), SIMATIC WinCC Unified V18 (All versions), SIMATIC WinCC Unified V19 (All versions < V19 Update 4), SIMATIC WinCC V17 (All versions), SIMATIC WinCC V18 (All versions
MATIC WinCC Unified V19 (All versions < V19 Update 4), SIMATIC WinCC V17 (All versions), SIMATIC WinCC V18 (All versions), SIMATIC WinCC V19 (All versions < V19 Update 4), SIMOCODE ES V17 (All versions), SIMOCODE ES V18 (All versions), SIMOCODE ES V19 (All versions), SIMOTION SCOUT TIA V5.4 (All versions), SIMOTION SCOUT TIA V5.5 (All versions), SIMOTION SCOUT TIA V5.6 (All versions < V5.6 SP1 HF7), SINAMICS Startdrive V17 (All versions), SINAMICS Startdrive V18 (All versions), SINAMICS Startdrive V19 (All versions), SIRIUS Safety ES V17 (TIA Portal) (All versions), SIRIUS Safety ES V18 (TIA Portal) (All versions), SIRIUS Safety ES V19 (TIA Portal) (All versions), SIRIUS Soft Starter ES V17
Safety ES V18 (TIA Portal) (All versions), SIRIUS Safety ES V19 (TIA Portal) (All versions), SIRIUS Soft Starter ES V17 (TIA Portal) (All versions), SIRIUS Soft Starter ES V18 (TIA Portal) (All versions), SIRIUS Soft Starter ES V19 (TIA Portal) (All versions), TIA Portal Cloud V17 (All versions), TIA Portal Cloud V18 (All versions), TIA Portal Cloud V19 (All versions < V5.2.1.1). The affected devices do not properly sanitize user-controllable input when parsing user settings. This could allow an attacker to locally execute arbitrary commands in the host operating system with the privileges of the user. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.sieme
h the privileges of the user. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-392859.html
CVE ID: CVE-2024-52052 State: PUBLISHED Published: 2024-11-21T22:20:15.758Z Last Updated: 2024-11-22T16:11:48.554Z Vendors: Wowza Products: Streaming Engine Problem Types: CWE-646 Description: Wowza Streaming Engine below 4.9.1 permits an authenticated Streaming Engine Manager administrator to define a custom application property and poison a stream target for high-privilege remote code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wowza.com/docs/wowza-streaming-engine-4-9-1-release-notes - https://www.rapid7.com/blog/post/2024/11/20/multiple-vulnerabilities-in-wowza-streaming-engine-fixed/
CVE ID: CVE-2024-52053 State: PUBLISHED Published: 2024-11-21T22:31:31.947Z Last Updated: 2024-11-22T16:10:58.456Z Vendors: Wowza Products: Streaming Engine Problem Types: CWE-79 Description: Stored Cross-Site Scripting in the Manager component of Wowza Streaming Engine below 4.9.1 allows an unauthenticated attacker to inject client-side JavaScript into the web dashboard to automatically hijack admin accounts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wowza.com/docs/wowza-streaming-engine-4-9-1-release-notes - https://www.rapid7.com/blog/post/2024/11/20/multiple-vulnerabilities-in-wowza-streaming-engine-fixed/
CVE ID: CVE-2024-52054 State: PUBLISHED Published: 2024-11-21T22:46:45.265Z Last Updated: 2024-11-21T23:30:52.532Z Vendors: Wowza Products: Streaming Engine Problem Types: CWE-22 Description: Path Traversal in the Manager component of Wowza Streaming Engine below 4.9.1 allows an administrator user to create an XML definition file anywhere on the file system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wowza.com/docs/wowza-streaming-engine-4-9-1-release-notes - https://www.rapid7.com/blog/post/2024/11/20/multiple-vulnerabilities-in-wowza-streaming-engine-fixed/
CVE ID: CVE-2024-52055 State: PUBLISHED Published: 2024-11-21T22:54:39.390Z Last Updated: 2024-11-21T23:30:17.107Z Vendors: Wowza Products: Streaming Engine Problem Types: CWE-22 Description: Path Traversal in the Manager component of Wowza Streaming Engine below 4.9.1 allows an administrator user to read any file on the file system if the target directory contains an XML definition file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wowza.com/docs/wowza-streaming-engine-4-9-1-release-notes - https://www.rapid7.com/blog/post/2024/11/20/multiple-vulnerabilities-in-wowza-streaming-engine-fixed/
CVE ID: CVE-2024-52056 State: PUBLISHED Published: 2024-11-21T22:59:40.509Z Last Updated: 2024-11-21T23:29:52.680Z Vendors: Wowza Products: Streaming Engine Problem Types: CWE-22 Description: Path Traversal in the Manager component of Wowza Streaming Engine below 4.9.1 allows an administrator user to delete any directory on the file system if the target directory contains an XML definition file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wowza.com/docs/wowza-streaming-engine-4-9-1-release-notes - https://www.rapid7.com/blog/post/2024/11/20/multiple-vulnerabilities-in-wowza-streaming-engine-fixed/