Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-41698 State: PUBLISHED Published: 2024-08-20T11:55:17.700Z Last Updated: 2024-08-20T13:13:08.722Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Priority Products: Priority Problem Types: CWE-200 Description: Priority – CWE-200: Exposure of Sensitive Information to an Unauthorized Actor Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.gov.il/en/Departments/faq/cve_advisories
CVE ID: CVE-2024-41699 State: PUBLISHED Published: 2024-08-20T12:00:22.274Z Last Updated: 2024-08-20T13:12:10.992Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: Priority Products: Priority Problem Types: CWE-552 Description: Priority – CWE-552: Files or Directories Accessible to External Parties Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.gov.il/en/Departments/faq/cve_advisories
CVE ID: CVE-2024-41700 State: PUBLISHED Published: 2024-08-20T12:05:10.315Z Last Updated: 2024-08-21T19:41:24.503Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Barix Products: Barix SIP Client Web Management Interface UI Problem Types: CWE-200 Description: Barix – CWE-200 Exposure of Sensitive Information to an Unauthorized Actor Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.gov.il/en/Departments/faq/cve_advisories
CVE ID: CVE-2024-41701 State: PUBLISHED Published: 2024-07-30T09:12:53.158Z Last Updated: 2024-08-02T04:46:52.730Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: AccuPOS Products: AccuPOS Problem Types: CWE-200 Description: AccuPOS - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.gov.il/en/Departments/faq/cve_advisories
CVE ID: CVE-2024-41702 State: PUBLISHED Published: 2024-07-30T09:18:04.027Z Last Updated: 2024-08-02T04:46:52.687Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: SiberianCMS Products: SiberianCMS v5.0.8 Problem Types: CWE-89 Description: SiberianCMS - CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.gov.il/en/Departments/faq/cve_advisories
CVE ID: CVE-2024-41703 State: PUBLISHED Published: 2024-07-22T00:00:00 Last Updated: 2024-08-23T20:16:05.165Z Vendors: n/a Products: n/a Problem Types: n/a Description: LibreChat through 0.7.4-rc1 has incorrect access control for message updates. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/danny-avila/LibreChat/pull/3363 - https://github.com/danny-avila/LibreChat/discussions/3315#discussioncomment-10074284 - https://github.com/realestate-com-au/vulnerability-disclosures/blob/main/LibreChat/CVE-2024-41703.md
CVE ID: CVE-2024-41704 State: PUBLISHED Published: 2024-07-22T00:00:00 Last Updated: 2024-08-22T20:33:40.681406 Vendors: n/a Products: n/a Problem Types: n/a Description: LibreChat through 0.7.4-rc1 does not validate the normalized pathnames of images. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/danny-avila/LibreChat/pull/3363 - https://github.com/danny-avila/LibreChat/discussions/3315#discussioncomment-10074284 - https://github.com/realestate-com-au/vulnerability-disclosures/blob/main/LibreChat/CVE-2024-41704.md
CVE ID: CVE-2024-41705 State: PUBLISHED Published: 2024-07-25T00:00:00 Last Updated: 2024-08-12T21:00:19.612Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AC:L/AV:L/A:N/C:H/I:H/PR:L/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: A stored XSS issue was discovered in Archer Platform 6.8 before 2024.06. A remote authenticated malicious Archer user could potentially exploit this to store malicious HTML or JavaScript code in a trusted application data store. When victim users access the data store through their browsers, the malicious code gets executed by the web browser in the context of the vulnerable application. 6.14.P4 (6.14.0.4) and 6.13 P4 (6.13.0.4) are also fixed releases. Th
wser in the context of the vulnerable application. 6.14.P4 (6.14.0.4) and 6.13 P4 (6.13.0.4) are also fixed releases. This vulnerability is similar to, but not identical to, CVE-2023-30639. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.archerirm.community/t5/platform-announcements/announcing-archer-platform-release-2024-06/ta-p/722094 - https://www.archerirm.community/t5/platform-announcements/archer-update-for-multiple-vulnerabilities/ta-p/739717
CVE ID: CVE-2024-41706 State: PUBLISHED Published: 2024-07-25T00:00:00 Last Updated: 2024-08-02T04:46:52.927Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AC:L/AV:N/A:N/C:H/I:H/PR:L/S:U/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: A stored XSS issue was discovered in Archer Platform 6 before version 2024.06. A remote authenticated malicious Archer user could potentially exploit this to store malicious HTML or JavaScript code in a trusted application data store. When victim users access the data store through their browsers, the malicious code gets executed by the web browser in the context of the vulnerable application. 6.14 P4 (6.14.0.4) is also a fixed release. Additional Analyst
eb browser in the context of the vulnerable application. 6.14 P4 (6.14.0.4) is also a fixed release. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.archerirm.community/t5/platform-announcements/announcing-archer-platform-release-2024-06/ta-p/722094 - https://www.archerirm.community/t5/platform-announcements/archer-update-for-multiple-vulnerabilities/ta-p/739717
CVE ID: CVE-2024-41707 State: PUBLISHED Published: 2024-07-25T00:00:00.000Z Last Updated: 2025-03-18T15:21:45.612Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AC:H/AV:N/A:N/C:H/I:N/PR:L/S:U/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Archer Platform 6 before 2024.06. Authenticated users can achieve HTML content injection. A remote authenticated malicious Archer user could potentially exploit this to store malicious HTML code in a trusted application data store. When victim users access the data store through their browsers, the malicious code gets executed by the web browser in the context of the vulnerable application. Additional Analyst Notes: - CISA
ous code gets executed by the web browser in the context of the vulnerable application. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.archerirm.community/t5/platform-announcements/announcing-archer-platform-release-2024-06/ta-p/722094 - https://www.archerirm.community/t5/platform-announcements/archer-update-for-multiple-vulnerabilities/ta-p/739717
CVE ID: CVE-2024-41708 State: PUBLISHED Published: 2024-09-25T00:00:00 Last Updated: 2024-09-26T14:09:34.930Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in AdaCore ada_web_services 20.0 allows an attacker to escalate privileges and steal sessions via the Random_String() function in the src/core/aws-utils.adb module. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/AdaCore/aws - https://docs.adacore.com/corp/security-advisories/SEC.AWS-0040-v2.pdf
CVE ID: CVE-2024-41709 State: PUBLISHED Published: 2024-07-22T00:00:00.000Z Last Updated: 2025-03-21T20:51:26.743Z Vendors: n/a Products: n/a Problem Types: n/a Description: Backdrop CMS before 1.27.3 and 1.28.x before 1.28.2 does not sufficiently sanitize field labels before they are displayed in certain places. This vulnerability is mitigated by the fact that an attacker must have a role with the "administer fields" permission. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://backdropcms.org/security/backdrop-sa-core-2024-001
CVE ID: CVE-2024-41710 State: PUBLISHED Published: 2024-08-12T00:00:00.000Z Last Updated: 2025-10-21T22:55:48.544Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones, including the 6970 Conference Unit, through R6.4.0.HF1 (R6.4.0.136) could allow an authenticated attacker with administrative privilege to conduct an argument injection attack, due to insufficient parameter sanitization during the boot process. A successful exploit could allow an attacker to execute arbitrary commands within the context of the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.mitel.com/s
thin the context of the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.mitel.com/support/security-advisories - https://github.com/kwburns/CVE/blob/main/Mitel/6.3.0.1020/README.md - https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-24-0019
CVE ID: CVE-2024-41711 State: PUBLISHED Published: 2024-08-13T00:00:00 Last Updated: 2024-08-14T15:41:44.554Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones, including the 6970 Conference Unit, through R6.4.0.HF1 (R6.4.0.136) could allow an unauthenticated attacker with physical access to the phone to conduct an argument injection attack, due to insufficient parameter sanitization. A successful exploit could allow an attacker to execute arbitrary commands within the context of the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.mitel.com/support/security-advisor
system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-24-0020
CVE ID: CVE-2024-41712 State: PUBLISHED Published: 2024-10-21T00:00:00 Last Updated: 2024-10-23T20:25:05.166Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability in the Web Conferencing Component of Mitel MiCollab through 9.8.1.5 could allow an authenticated attacker to conduct a command injection attack, due to insufficient validation of user input. A successful exploit could allow an attacker to execute arbitrary commands on the system within the context of the user. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-24-0022
CVE ID: CVE-2024-41713 State: PUBLISHED Published: 2024-10-21T00:00:00.000Z Last Updated: 2025-10-21T22:55:42.233Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated attacker to conduct a path traversal attack, due to insufficient input validation. A successful exploit could allow unauthorized access, enabling the attacker to view, corrupt, or delete users' data and system configurations. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-misa-20
DP Vulnrichment: References: - https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-misa-2024-0029
CVE ID: CVE-2024-41714 State: PUBLISHED Published: 2024-10-21T00:00:00 Last Updated: 2024-10-22T14:03:51.621Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability in the Web Interface component of Mitel MiCollab through 9.8 SP1 (9.8.1.5) and MiVoice Business Solution Virtual Instance (MiVB SVI) through 1.0.0.27 could allow an authenticated attacker to conduct a command injection attack, due to insufficient parameter sanitization. A successful exploit could allow an attacker to execute arbitrary commands with elevated privileges within the context of the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.mitel.com/support/security-adviso
e system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-24-0021
CVE ID: CVE-2024-41715 State: PUBLISHED Published: 2024-09-26T17:46:05.011Z Last Updated: 2024-10-17T17:03:47.283Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: goTenna Products: Pro ATAK Plugin Problem Types: CWE-204 Description: The goTenna Pro ATAK Plugin does not inject extra characters into broadcasted frames to obfuscate the length of messages. This makes it possible to tell the length of the payload regardless of the encryption used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-270-05
CVE ID: CVE-2024-41716 State: PUBLISHED Published: 2024-09-04T00:34:12.610Z Last Updated: 2025-03-13T14:15:40.744Z Vendors: IDEC Corporation Products: WindLDR, WindO/I-NV4 Problem Types: Cleartext storage of sensitive information Description: Cleartext storage of sensitive information vulnerability exists in WindLDR and WindO/I-NV4. If this vulnerability is exploited, an attacker who obtained the product's project file may obtain user credentials of the PLC or Operator Interfaces. As a result, an attacker may be able to manipulate and/or suspend the PLC and Operator Interfaces by accessing or hijacking them. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://us.idec.com
ces by accessing or hijacking them. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://us.idec.com/media/24-RD-0219-EN.pdf - https://jvn.jp/en/jp/JVN08342147/
CVE ID: CVE-2024-41717 State: PUBLISHED Published: 2024-10-22T21:13:37.183Z Last Updated: 2024-10-23T14:43:52.114Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Kieback & Peter, Kieback&Peter Products: DDC4040e, DDC4020e, DDC4400e, DDC4200e, DDC4002e, DDC4400, DDC4200-L, DDC4200, DDC4100, DDC4002 Problem Types: CWE-22 Description: Kieback & Peter's DDC4000 series is vulnerable to a path traversal vulnerability, which may allow an unauthenticated attacker to read files on the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-291-05
CVE ID: CVE-2024-41718 State: REJECTED Published: N/A Last Updated: 2024-09-03T10:35:36.573Z Description: No description available.
CVE ID: CVE-2024-41719 State: PUBLISHED Published: 2024-08-14T14:32:32.375Z Last Updated: 2024-08-14T15:52:12.724Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N) Vendors: F5 Products: BIG-IP Next Central Manager Problem Types: CWE-532 Description: When generating QKView of BIG-IP Next instance from the BIG-IP Next Central Manager (CM), F5 iHealth credentials will be logged in the BIG-IP Central Manager logs. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://my.f5.com/manage/s/article/K000140006
CVE ID: CVE-2024-41720 State: PUBLISHED Published: 2024-08-05T04:36:17.042Z Last Updated: 2025-03-17T15:02:35.181Z Vendors: ZEXELON CO., LTD. Products: ZWX-2000CSW2-HN Problem Types: Incorrect Permission Assignment for Critical Resource Description: Incorrect permission assignment for critical resource issue exists in ZWX-2000CSW2-HN firmware versions prior to Ver.0.3.15, which may allow a network-adjacent authenticated attacker to alter the configuration of the device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zexelon.co.jp/pdf/jvn70666401.pdf - https://jvn.jp/en/jp/JVN70666401/
CVE ID: CVE-2024-41721 State: PUBLISHED Published: 2024-09-20T07:51:22.548Z Last Updated: 2024-09-26T15:03:10.183Z Vendors: FreeBSD Products: FreeBSD Problem Types: CWE-125 Description: An insufficient boundary validation in the USB code could lead to an out-of-bounds read on the heap, which could potentially lead to an arbitrary write and remote code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://security.freebsd.org/advisories/FreeBSD-SA-24:15.bhyve.asc
CVE ID: CVE-2024-41722 State: PUBLISHED Published: 2024-09-26T17:39:46.735Z Last Updated: 2024-10-17T16:59:45.950Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: goTenna Products: Pro ATAK Plugin Problem Types: CWE-1390 Description: In the goTenna Pro ATAK Plugin there is a vulnerability that makes it possible to inject any custom message with any GID and Callsign using a software defined radio in existing goTenna mesh networks. This vulnerability can be exploited if the device is being used in an unencrypted environment or if the cryptography has already been compromised. It is advised to use encryption shared with local QR code for higher security operati
aphy has already been compromised. It is advised to use encryption shared with local QR code for higher security operations. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-270-05
CVE ID: CVE-2024-41723 State: PUBLISHED Published: 2024-08-14T14:32:30.852Z Last Updated: 2024-08-16T19:06:02.769Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: F5 Products: BIG-IP Problem Types: CWE-200 Description: Undisclosed requests to BIG-IP iControl REST can lead to information leak of user account names. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://my.f5.com/manage/s/article/K10438187
CVE ID: CVE-2024-41724 State: PUBLISHED Published: 2025-03-10T02:44:36.469Z Last Updated: 2025-03-10T17:10:26.436Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N) Vendors: Gallagher Products: Command Centre Server Problem Types: CWE-295 Description: Improper Certificate Validation (CWE-295) in the Gallagher Command Centre SALTO integration allowed an attacker to spoof the SALTO server. This issue affects all versions of Gallagher Command Centre prior to 9.20.1043. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2024-41724
CVE ID: CVE-2024-41725 State: PUBLISHED Published: 2024-09-24T23:44:04.492Z Last Updated: 2024-09-25T17:01:33.873Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Dover Fueling Solutions (DFS) Products: ProGauge MAGLINK LX CONSOLE, ProGauge MAGLINK LX4 CONSOLE Problem Types: CWE-79 Description: ProGauge MAGLINK LX CONSOLE does not have sufficient filtering on input fields that are used to render pages which may allow cross site scripting. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-268-04
CVE ID: CVE-2024-41726 State: PUBLISHED Published: 2024-07-29T08:51:08.388Z Last Updated: 2024-08-02T04:46:52.686Z Vendors: Sky Co.,LTD. Products: SKYSEA Client View Problem Types: Path traversal Description: Path traversal vulnerability exists in SKYSEA Client View Ver.3.013.00 to Ver.19.210.04e. If this vulnerability is exploited, an arbitrary executable file may be executed by a user who can log in to the PC where the product's Windows client is installed. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.skyseaclientview.net/news/240729_02/ - https://jvn.jp/en/jp/JVN84326763/
CVE ID: CVE-2024-41727 State: PUBLISHED Published: 2024-08-14T14:32:32.000Z Last Updated: 2024-08-14T17:43:47.392Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: F5 Products: BIG-IP Problem Types: CWE-400 Description: In BIG-IP tenants running on r2000 and r4000 series hardware, or BIG-IP Virtual Edition (VEs) using Intel E810 SR-IOV NIC, undisclosed traffic can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://my.f5.com/manage/s/article/K000138833
CVE ID: CVE-2024-41728 State: PUBLISHED Published: 2024-09-10T04:00:56.713Z Last Updated: 2024-09-10T13:26:14.224Z Severity: LOW (CVSS 2.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N) Vendors: SAP_SE Products: SAP NetWeaver Application Server for ABAP and ABAP Platform Problem Types: CWE-862 Description: Due to missing authorization check, SAP NetWeaver Application Server for ABAP and ABAP Platform allows an attacker logged in as a developer to read objects contained in a package. This causes an impact on confidentiality, as this attacker would otherwise not have access to view these objects. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3496410 -
view these objects. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3496410 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2024-41729 State: PUBLISHED Published: 2024-09-10T02:33:32.937Z Last Updated: 2024-09-10T14:05:36.468Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: SAP_SE Products: SAP NetWeaver BW (BEx Analyzer) Problem Types: CWE-359, CWE-862 Description: Due to missing authorization checks, SAP BEx Analyzer allows an authenticated attacker to access information over the network which is otherwise restricted. On successful exploitation the attacker can enumerate information causing a limited impact on confidentiality of the application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3481588 - https://url.sap/sapsec
ditional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3481588 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2024-41730 State: PUBLISHED Published: 2024-08-13T03:31:37.327Z Last Updated: 2024-08-16T04:01:44.403Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: SAP_SE Products: SAP BusinessObjects Business Intelligence Platform Problem Types: CWE-862 Description: In SAP BusinessObjects Business Intelligence Platform, if Single Signed On is enabled on Enterprise authentication, an unauthorized user can get a logon token using a REST endpoint. The attacker can fully compromise the system resulting in High impact on confidentiality, integrity and availability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3479478
rity and availability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3479478 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2024-41731 State: PUBLISHED Published: 2024-08-13T04:07:28.131Z Last Updated: 2024-12-10T06:23:32.782Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: SAP_SE Products: SAP BusinessObjects Business Intelligence Platform Problem Types: CWE-434 Description: SAP BusinessObjects Business Intelligence Platform allows an authenticated attacker to upload malicious code over the network, that could be executed by the application. On successful exploitation, the attacker can cause a low impact on the Integrity of the application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3433545 - https://me.sap.com/notes/351565
CVE ID: CVE-2024-41732 State: PUBLISHED Published: 2024-08-13T03:58:36.444Z Last Updated: 2024-08-13T13:28:06.622Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: SAP_SE Products: SAP NetWeaver Application Server ABAP Problem Types: CWE-284 Description: SAP NetWeaver Application Server ABAP allows an unauthenticated attacker to craft a URL link that could bypass allowlist controls. Depending on the web applications provided by this server, the attacker might inject CSS code or links into the web application that could allow the attacker to read or modify information. There is no impact on availability of application. Additional Analyst Notes: - CISA ADP Vuln