Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-41127 State: PUBLISHED Published: 2024-08-02T14:46:21.941Z Last Updated: 2024-08-02T16:52:08.440Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: monkeytypegame Products: monkeytype Problem Types: CWE-74 Description: Monkeytype is a minimalistic and customizable typing test. Monkeytype is vulnerable to Poisoned Pipeline Execution through Code Injection in its ci-failure-comment.yml GitHub Workflow, enabling attackers to gain pull-requests write access. The ci-failure-comment.yml workflow is triggered when the Monkey CI workflow completes. When it runs, it will download an artifact uploaded by the triggering workflow and assign the contents of
ow completes. When it runs, it will download an artifact uploaded by the triggering workflow and assign the contents of ./pr_num/pr_num.txt artifact to the steps.pr_num_reader.outputs.content WorkFlow variable. It is not validated that the variable is actually a number and later it is interpolated into a JS script allowing an attacker to change the code to be executed. This issue leads to pull-requests write access. This vulnerability is fixed in 24.30.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/monkeytypegame/monkeytype/security/advisories/GHSA-wcjf-5464-4wq9 - https://github.com/monkeytypegame/monkeytype/commit/29627fd0d5f152e2da59671987090ea0a5c2
dvisories/GHSA-wcjf-5464-4wq9 - https://github.com/monkeytypegame/monkeytype/commit/29627fd0d5f152e2da59671987090ea0a5c29874 - https://securitylab.github.com/advisories/GHSL-2024-167_monkeytype
CVE ID: CVE-2024-41128 State: PUBLISHED Published: 2024-10-16T18:04:42.501Z Last Updated: 2024-10-17T17:11:51.031Z Vendors: rails Products: rails Problem Types: CWE-770 Description: Action Pack is a framework for handling and responding to web requests. Starting in version 3.1.0 and prior to versions 6.1.7.9, 7.0.8.5, 7.1.4.1, and 7.2.1.1, there is a possible ReDoS vulnerability in the query parameter filtering routines of Action Dispatch. Carefully crafted query parameters can cause query parameter filtering to take an unexpected amount of time, possibly resulting in a DoS vulnerability. All users running an affected release should either upgrade to version 6.1.7.9, 7.0.8.5, 7.1.4.1, or 7.2
vulnerability. All users running an affected release should either upgrade to version 6.1.7.9, 7.0.8.5, 7.1.4.1, or 7.2.1.1 or apply the relevant patch immediately. One may use Ruby 3.2 as a workaround. Ruby 3.2 has mitigations for this problem, so Rails applications using Ruby 3.2 or newer are unaffected. Rails 8.0.0.beta1 depends on Ruby 3.2 or greater so is unaffected. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/rails/rails/security/advisories/GHSA-x76w-6vjr-8xgj - https://github.com/rails/rails/commit/27121e80f6dbb260f5a9f0452cd8411cb681f075 - https://github.com/rails/rails/commit/b0fe99fa854ec8ff4498e75779b458392d1560ef - https://github.com/rails
411cb681f075 - https://github.com/rails/rails/commit/b0fe99fa854ec8ff4498e75779b458392d1560ef - https://github.com/rails/rails/commit/b1241f468d1b32235f438c2e2203386e6efd3891 - https://github.com/rails/rails/commit/fb493bebae1a9b83e494fe7edbf01f6167d606fd - https://access.redhat.com/security/cve/cve-2024-41128 - https://bugzilla.redhat.com/show_bug.cgi?id=2319036
CVE ID: CVE-2024-41129 State: PUBLISHED Published: 2024-07-22T14:20:08.920Z Last Updated: 2024-08-02T04:46:52.414Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: canonical Products: operator Problem Types: CWE-532 Description: The ops library is a Python framework for developing and testing Kubernetes and machine charms. The issue here is that ops passes the secret content as one of the args via CLI. This issue may affect any of the charms that are using: Juju (>=3.0), Juju secrets and not correctly capturing and processing `subprocess.CalledProcessError`. This vulnerability is fixed in 2.15.0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Progra
ledProcessError`. This vulnerability is fixed in 2.15.0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/canonical/operator/security/advisories/GHSA-hcmv-jmqh-fjgm - https://github.com/canonical/operator/commit/fea6d2072435a62170d4c01272572f1a7e916e61
CVE ID: CVE-2024-41130 State: PUBLISHED Published: 2024-07-22T17:28:47.708Z Last Updated: 2024-08-02T04:46:51.141Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: ggerganov Products: llama.cpp Problem Types: CWE-476 Description: llama.cpp provides LLM inference in C/C++. Prior to b3427, llama.cpp contains a null pointer dereference in gguf_init_from_file. This vulnerability is fixed in b3427. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/ggerganov/llama.cpp/security/advisories/GHSA-49q7-2jmh-92fp - https://github.com/ggerganov/llama.cpp/commit/07283b1a90e1320aae4762c7e03c879043910252
CVE ID: CVE-2024-41131 State: PUBLISHED Published: 2024-07-22T14:24:42.461Z Last Updated: 2024-08-02T04:46:52.374Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: SixLabors Products: ImageSharp Problem Types: CWE-787 Description: ImageSharp is a 2D graphics API. An Out-of-bounds Write vulnerability has been found in the ImageSharp gif decoder, allowing attackers to cause a crash using a specially crafted gif. This can potentially lead to denial of service. All users are advised to upgrade to v3.1.5 or v2.1.9. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/SixLabors/ImageSharp/security/advisories/GHS
ADP Vulnrichment: - CVE Program Container: References: - https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-63p8-c4ww-9cg7 - https://github.com/SixLabors/ImageSharp/pull/2754 - https://github.com/SixLabors/ImageSharp/pull/2756 - https://github.com/SixLabors/ImageSharp/commit/9dda64a8186af67baf06b6d9c1ab599c3608b693 - https://github.com/SixLabors/ImageSharp/commit/a1f287977139109a987065643b8172c748abdadb
CVE ID: CVE-2024-41132 State: PUBLISHED Published: 2024-07-22T14:28:25.348Z Last Updated: 2024-08-02T04:46:52.026Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: SixLabors Products: ImageSharp Problem Types: CWE-789 Description: ImageSharp is a 2D graphics API. A vulnerability discovered in the ImageSharp library, where the processing of specially crafted files can lead to excessive memory usage in the Gif decoder. The vulnerability is triggered when ImageSharp attempts to process image files that are designed to exploit this flaw. All users are advised to upgrade to v3.1.5 or v2.1.9. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Containe
rs are advised to upgrade to v3.1.5 or v2.1.9. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-qxrv-gp6x-rc23 - https://github.com/SixLabors/ImageSharp/pull/2759 - https://github.com/SixLabors/ImageSharp/pull/2764 - https://github.com/SixLabors/ImageSharp/pull/2770 - https://github.com/SixLabors/ImageSharp/commit/59de13c8cc47f2b402e2c43aa7024511d029d515 - https://github.com/SixLabors/ImageSharp/commit/9816ca45016c5d3859986f3c600e8934bc450a56 - https://github.com/SixLabors/ImageSharp/commit/b496109051cc39feee1f6cde48fca6481de17f9a - https://docs.sixlabors.com/articles/imagesharp.web/proc
ors/ImageSharp/commit/b496109051cc39feee1f6cde48fca6481de17f9a - https://docs.sixlabors.com/articles/imagesharp.web/processingcommands.html#securing-processing-commands - https://docs.sixlabors.com/articles/imagesharp/security.html
CVE ID: CVE-2024-41133 State: PUBLISHED Published: 2024-07-24T20:00:19.562Z Last Updated: 2024-08-02T04:46:52.469Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Hewlett Packard Enterprise (HPE) Products: HPE Aruba Networking EdgeConnect SD-WAN Description: A vulnerability exists in the HPE Aruba Networking EdgeConnect SD-WAN gateway's Command Line Interface that allows remote authenticated users to run arbitrary commands on the underlying host. Successful exploitation of this vulnerability will result in the ability to execute arbitrary commands as root on the underlying operating system leading to complete system compromise Additional Analyst Notes: - CISA
mands as root on the underlying operating system leading to complete system compromise Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://csaf.arubanetworks.com/2024/hpe_aruba_networking_-_hpesbnw04673.txt
CVE ID: CVE-2024-41134 State: PUBLISHED Published: 2024-07-24T20:02:19.471Z Last Updated: 2024-08-02T04:46:51.648Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Hewlett Packard Enterprise (HPE) Products: HPE Aruba Networking EdgeConnect SD-WAN Description: A vulnerability exists in the HPE Aruba Networking EdgeConnect SD-WAN gateway's Command Line Interface that allows remote authenticated users to run arbitrary commands on the underlying host. Successful exploitation of this vulnerability will result in the ability to execute arbitrary commands as root on the underlying operating system leading to complete system compromise Additional Analyst Notes: - CISA
CVE ID: CVE-2024-41135 State: PUBLISHED Published: 2024-07-24T20:03:45.603Z Last Updated: 2024-08-02T04:46:52.383Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Hewlett Packard Enterprise (HPE) Products: HPE Aruba Networking EdgeConnect SD-WAN Description: A vulnerability exists in the HPE Aruba Networking EdgeConnect SD-WAN gateway's Command Line Interface that allows remote authenticated users to run arbitrary commands on the underlying host. Successful exploitation of this vulnerability will result in the ability to execute arbitrary commands as root on the underlying operating system leading to complete system compromise Additional Analyst Notes: - CISA
CVE ID: CVE-2024-41136 State: PUBLISHED Published: 2024-07-24T20:05:42.905Z Last Updated: 2024-08-02T04:46:51.624Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H) Vendors: Hewlett Packard Enterprise (HPE) Products: HPE Aruba Networking EdgeConnect SD-WAN Description: An authenticated command injection vulnerability exists in the HPE Aruba Networking EdgeConnect SD-WAN gateways Command Line Interface. Successful exploitation of this vulnerability results in the ability to execute arbitrary commands as a privileged user on the underlying operating system. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://csaf.arubanetwork
tem. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://csaf.arubanetworks.com/2024/hpe_aruba_networking_-_hpesbnw04673.txt
CVE ID: CVE-2024-41138 State: PUBLISHED Published: 2024-12-18T22:38:04.909Z Last Updated: 2024-12-20T17:24:19.729Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: Microsoft Products: Teams (work or school) Problem Types: CWE-347 Description: A library injection vulnerability exists in the com.microsoft.teams2.modulehost.app helper app of Microsoft Teams (work or school) 24046.2813.2770.1094 for macOS. A specially crafted library can leverage Teams's access privileges, leading to a permission bypass. A malicious application could inject a library and start the program to trigger this vulnerability and then make use of the vulnerable application's permissions. A
ary and start the program to trigger this vulnerability and then make use of the vulnerable application's permissions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2024-1991
CVE ID: CVE-2024-41139 State: PUBLISHED Published: 2024-07-29T08:51:00.898Z Last Updated: 2024-08-12T20:52:55.611Z Vendors: Sky Co.,LTD. Products: SKYSEA Client View Problem Types: Incorrect privilege assignment Description: Incorrect privilege assignment vulnerability exists in SKYSEA Client View Ver.6.010.06 to Ver.19.210.04e. If a user who can log in to the PC where the product's Windows client is installed places a specially crafted DLL file in a specific folder, arbitrary code may be executed with SYSTEM privilege. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.skyseaclientview.net/news/240729_02/ - https://jvn.jp/en/jp/JVN84326763/
CVE ID: CVE-2024-41140 State: PUBLISHED Published: 2025-01-29T11:14:50.910Z Last Updated: 2025-02-12T19:51:14.429Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: ManageEngine Products: Applications Manager Problem Types: CWE-863 Description: Zohocorp ManageEngine Applications Manager versions 174000 and prior are vulnerable to the incorrect authorization in the update user function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2024-41140.html
CVE ID: CVE-2024-41141 State: PUBLISHED Published: 2024-07-30T08:45:40.826Z Last Updated: 2024-11-06T16:20:46.457Z Vendors: EC-CUBE CO.,LTD. Products: EC-CUBE Web API Plugin, EC-CUBE Web API Plugin (4.2 series) Problem Types: Cross-site scripting (XSS) Description: Stored cross-site scripting vulnerability exists in EC-CUBE Web API Plugin. When there are multiple users using OAuth Management feature and one of them inputs some crafted value on the OAuth Management page, an arbitrary script may be executed on the web browser of the other user who accessed the management page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ec-cube.net/info
. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ec-cube.net/info/weakness/20240701/web_api_plugin.php - https://jvn.jp/en/jp/JVN26225832/
CVE ID: CVE-2024-41143 State: PUBLISHED Published: 2024-07-29T08:51:04.801Z Last Updated: 2025-03-14T15:44:48.226Z Vendors: Sky Co.,LTD. Products: SKYSEA Client View Problem Types: Origin validation error Description: Origin validation error vulnerability exists in SKYSEA Client View Ver.3.013.00 to Ver.19.210.04e. If this vulnerability is exploited, an arbitrary process may be executed with SYSTEM privilege by a user who can log in to the PC where the product's Windows client is installed. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.skyseaclientview.net/news/240729_02/ - https://jvn.jp/en/jp/JVN84326763/
CVE ID: CVE-2024-41144 State: PUBLISHED Published: 2024-08-01T14:05:08.491Z Last Updated: 2024-08-05T16:58:34.663Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L) Vendors: Mattermost Products: Mattermost Problem Types: CWE-284 Description: Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5, 9.8.x <= 9.8.1 fail to properly validate synced posts, when shared channels are enabled, which allows a malicious remote to create/update/delete arbitrary posts in arbitrary channels Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2024-41145 State: PUBLISHED Published: 2024-12-18T22:38:38.457Z Last Updated: 2024-12-28T00:51:29.124Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: Microsoft Products: Teams (work or school) Problem Types: CWE-347 Description: A library injection vulnerability exists in the WebView.app helper app of Microsoft Teams (work or school) 24046.2813.2770.1094 for macOS. A specially crafted library can leverage Teams's access privileges, leading to a permission bypass. A malicious application could inject a library and start the program to trigger this vulnerability and then make use of the vulnerable application's permissions. Additional Analyst Notes:
m to trigger this vulnerability and then make use of the vulnerable application's permissions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2024-1990
CVE ID: CVE-2024-41146 State: PUBLISHED Published: 2024-12-12T01:35:38.236Z Last Updated: 2024-12-12T15:19:50.478Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Gallagher Products: Controller 6000 and Controller 7000 Problem Types: CWE-694 Description: Use of Multiple Resources with Duplicate Identifier (CWE-694) in the Controller 6000 and Controller 7000 Platforms could allow an attacker with physical access to HBUS communication cabling to perform a Denial-of-Service attack against HBUS connected devices, require a device reboot to resolve. This issue affects: Controller 6000 and Controller 7000 firmware versions 9.10 prior to vCR9.10.241108a (distribute
lve. This issue affects: Controller 6000 and Controller 7000 firmware versions 9.10 prior to vCR9.10.241108a (distributed in 9.10.2149 (MR4)), 9.00 prior to vCR9.00.241108a (distributed in 9.00.2374 (MR5)), 8.90 prior to vCR8.90.241107a (distributed in 8.90.2356 (MR6)), all versions of 8.80 and prior. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2024-41146
CVE ID: CVE-2024-41147 State: PUBLISHED Published: 2025-03-04T17:21:23.976Z Last Updated: 2025-03-04T19:02:31.293Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H) Vendors: Miniaudio Products: Miniaudio Problem Types: CWE-122 Description: An out-of-bounds write vulnerability exists in the ma_dr_flac__decode_samples__lpc functionality of Miniaudio miniaudio v0.11.21. A specially crafted .flac file can lead to memory corruption. An attacker can provide a malicious file to trigger this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2024-2063
CVE ID: CVE-2024-41148 State: PUBLISHED Published: 2025-07-17T19:12:54.440Z Last Updated: 2025-07-18T08:04:55.109Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Open Source Robotics Foundation Products: Robot Operating System (ROS) Problem Types: CWE-95, CWE-94 Description: A code injection vulnerability has been discovered in the Robot Operating System (ROS) 'rostopic' command-line tool, affecting ROS distributions Noetic Ninjemys and earlier. The vulnerability lies in the 'hz' verb, which reports the publishing rate of a topic and accepts a user-provided Python expression via the --filter option. This input is passed directly to the eval() function without
a user-provided Python expression via the --filter option. This input is passed directly to the eval() function without sanitization, allowing a local user to craft and execute arbitrary code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ros.org/blog/noetic-eol/
CVE ID: CVE-2024-41149 State: PUBLISHED Published: 2025-01-11T12:35:33.428Z Last Updated: 2025-05-04T09:22:05.525Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: block: avoid to reuse `hctx` not removed from cpuhp callback list If the 'hctx' isn't removed from cpuhp callback list, we can't reuse it, otherwise use-after-free may be triggered. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/ee18012c80155f6809522804099621070c69ec72 - https://git.kernel.org/stable/c/b5792c162dcf6197bf3d2de2be6c8169435b73d0 - https://git.kernel.org/stable/c/85672ca9ceeaa1dcf2777a7048af5f4aee3fd02b
CVE ID: CVE-2024-41150 State: PUBLISHED Published: 2024-08-23T14:08:17.169Z Last Updated: 2024-08-23T14:38:15.256Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N) Vendors: ManageEngine Products: ServiceDesk Plus, ServiceDesk Plus MSP, SupportCenter Plus Problem Types: CWE-79 Description: An Stored Cross-site Scripting vulnerability in request module affects Zohocorp ManageEngine ServiceDesk Plus, ServiceDesk Plus MSP and SupportCenter Plus.This issue affects ServiceDesk Plus versions: through 14810; ServiceDesk Plus MSP: through 14800; SupportCenter Plus: through 14800. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.manageengine.com/prod
Plus: through 14800. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.manageengine.com/products/service-desk/CVE-2024-41150.html
CVE ID: CVE-2024-41151 State: PUBLISHED Published: 2024-11-18T08:45:49.288Z Last Updated: 2024-11-18T15:07:22.821Z Vendors: Apache Software Foundation Products: Apache HertzBeat Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in Apache HertzBeat. This vulnerability can only be exploited by authorized attackers. This issue affects Apache HertzBeat: before 1.6.1. Users are recommended to upgrade to version 1.6.1, which fixes the issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/p33tg0vo5nh6kscth4262ktsqo3h5lqo - https://lists.apache.org/thread/oor9nw6nh2ojnfw8d8oxrv40cbtk5mwj
CVE ID: CVE-2024-41153 State: PUBLISHED Published: 2024-10-29T12:30:31.402Z Last Updated: 2025-11-04T16:00:52.178Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Hitachi Energy Products: TRO600 Problem Types: CWE-78 Description: Command injection vulnerability in the Edge Computing UI for the TRO600 series radios that allows for the execution of arbitrary system commands. If exploited, an attacker with write access to the web UI can execute commands on the device with root privileges, far more extensive than what the write privilege intends. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://publisher.hitachienergy.com/preview?DocumentID
Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://publisher.hitachienergy.com/preview?DocumentID=8DBD000147&LanguageCode=en&DocumentPartId=&Action=launch
CVE ID: CVE-2024-41156 State: PUBLISHED Published: 2024-10-29T12:44:58.707Z Last Updated: 2025-01-09T17:15:38.962Z Severity: LOW (CVSS 2.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N) Vendors: Hitachi Energy Products: TRO600 Problem Types: CWE-212 Description: Profile files from TRO600 series radios are extracted in plain-text and encrypted file formats. Profile files provide potential attackers valuable configuration information about the Tropos network. Profiles can only be exported by authenticated users with higher privilege of write access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://publisher.hitachienergy.com/preview?DocumentID=8DBD000147&LanguageCode=en&
CISA ADP Vulnrichment: References: - https://publisher.hitachienergy.com/preview?DocumentID=8DBD000147&LanguageCode=en&DocumentPartId=&Action=launch
CVE ID: CVE-2024-41157 State: PUBLISHED Published: 2024-09-02T03:25:17.414Z Last Updated: 2024-09-03T14:52:17.647Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: OpenHarmony Products: OpenHarmony Problem Types: CWE-416 Description: in OpenHarmony v4.1.0 and prior versions allow a local attacker cause the common permission is upgraded to root and sensitive information leak through use after free. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2024/2024-09.md