Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-42022 State: PUBLISHED Published: 2024-09-07T16:11:22.220Z Last Updated: 2024-09-09T14:15:21.746Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Veeam Products: One Description: An incorrect permission assignment vulnerability allows an attacker to modify product configuration files. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.veeam.com/kb4649
CVE ID: CVE-2024-42023 State: PUBLISHED Published: 2024-09-07T16:11:22.238Z Last Updated: 2024-09-09T13:36:19.461Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Veeam Products: One Description: An improper access control vulnerability allows low-privileged users to execute code with Administrator privileges remotely. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.veeam.com/kb4649
CVE ID: CVE-2024-42024 State: PUBLISHED Published: 2024-09-07T16:11:22.220Z Last Updated: 2024-09-09T14:11:39.524Z Severity: CRITICAL (CVSS 9.1 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Veeam Products: One Description: A vulnerability that allows an attacker in possession of the Veeam ONE Agent service account credentials to perform remote code execution on the machine where the Veeam ONE Agent is installed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.veeam.com/kb4649
CVE ID: CVE-2024-42025 State: PUBLISHED Published: 2024-09-13T15:47:19.568Z Last Updated: 2024-09-28T17:44:02.226Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Ubiquiti Inc Products: UniFi Network Application Description: A Command Injection vulnerability found in a Self-Hosted UniFi Network Servers (Linux) with UniFi Network Application (Version 8.3.32 and earlier) allows a malicious actor with unifi user shell access to escalate privileges to root on the host device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://community.ui.com/releases/Security-Advisory-Bulletin-042-042/c4f68b56-cdc4-4128-b2cb-5870209d1704
CVE ID: CVE-2024-42027 State: PUBLISHED Published: 2024-10-07T12:46:16.115Z Last Updated: 2024-10-07T14:59:56.828Z Severity: MEDIUM (CVSS 6.7 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L) Vendors: Rocket.Chat Products: Mobile Description: The E2EE password entropy generated by Rocket.Chat Mobile prior to version 4.5.1 is insufficient, allowing attackers to crack it if they have the appropriate time and resources. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://hackerone.com/reports/2546437
CVE ID: CVE-2024-42028 State: PUBLISHED Published: 2024-10-28T15:54:15.384Z Last Updated: 2024-10-28T18:53:11.285Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Ubiquiti Inc Products: UniFi Network Application Description: A Local privilege escalation vulnerability found in a Self-Hosted UniFi Network Server with UniFi Network Application (Version 8.4.62 and earlier) allows a malicious actor with a local operational system user to execute high privilege actions on UniFi Network Server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://community.ui.com/releases/Security-Advisory-Bulletin-043-043/28e45c75-314e-4f07-a4f3-d17f67bd53f7
CVE ID: CVE-2024-42029 State: PUBLISHED Published: 2024-07-27T00:00:00 Last Updated: 2024-08-02T04:54:31.354Z Vendors: n/a Products: n/a Problem Types: n/a Description: xdg-desktop-portal-hyprland (aka an XDG Desktop Portal backend for Hyprland) before 1.3.3 allows OS command execution, e.g., because single quotes are not used when sending a list of app IDs and titles via the environment. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/hyprwm/xdg-desktop-portal-hyprland/issues/242 - https://github.com/hyprwm/xdg-desktop-portal-hyprland/commit/0bb709491baffd69f4f861802f00cf60c77cc2cd - https://github.com/hyprwm/xdg-desktop-portal-hy
esktop-portal-hyprland/commit/0bb709491baffd69f4f861802f00cf60c77cc2cd - https://github.com/hyprwm/xdg-desktop-portal-hyprland/releases/tag/v1.3.3
CVE ID: CVE-2024-42030 State: PUBLISHED Published: 2024-08-08T08:13:26.981Z Last Updated: 2024-08-09T17:50:23.235Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Huawei Products: HarmonyOS, EMUI Problem Types: CWE-701 Description: Access permission verification vulnerability in the content sharing pop-up module Impact: Successful exploitation of this vulnerability may affect service confidentiality. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://consumer.huawei.com/en/support/bulletin/2024/8/
CVE ID: CVE-2024-42031 State: PUBLISHED Published: 2024-08-08T08:56:57.339Z Last Updated: 2025-03-19T15:56:45.958Z Vendors: Huawei Products: HarmonyOS, EMUI Problem Types: CWE-16 Description: Access permission verification vulnerability in the Settings module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://consumer.huawei.com/en/support/bulletin/2024/8/
CVE ID: CVE-2024-42032 State: PUBLISHED Published: 2024-08-08T09:05:15.059Z Last Updated: 2025-09-18T06:32:42.373Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: Huawei Products: HarmonyOS, EMUI Problem Types: CWE-285 Description: Access permission verification vulnerability in the Contacts module Impact: Successful exploitation of this vulnerability may affect service confidentiality. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://consumer.huawei.com/en/support/bulletin/2024/8/
CVE ID: CVE-2024-42033 State: PUBLISHED Published: 2024-08-08T09:21:20.866Z Last Updated: 2025-09-18T06:33:32.402Z Severity: MEDIUM (CVSS 6.9 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:L) Vendors: Huawei Products: HarmonyOS, EMUI Problem Types: CWE-284 Description: Access control vulnerability in the security verification module mpact: Successful exploitation of this vulnerability will affect integrity and confidentiality. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://consumer.huawei.com/en/support/bulletin/2024/8/
CVE ID: CVE-2024-42034 State: PUBLISHED Published: 2024-08-08T09:23:38.895Z Last Updated: 2024-08-08T13:09:16.945Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L) Vendors: Huawei Products: HarmonyOS, EMUI Problem Types: CWE-840 Description: LaunchAnywhere vulnerability in the account module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://https://consumer.huawei.com/en/support/bulletin/2024/8/
CVE ID: CVE-2024-42035 State: PUBLISHED Published: 2024-08-08T09:26:10.805Z Last Updated: 2025-09-18T06:34:01.791Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Huawei Products: HarmonyOS, EMUI Problem Types: CWE-862 Description: Permission control vulnerability in the App Multiplier module Impact:Successful exploitation of this vulnerability may affect functionality and confidentiality. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://consumer.huawei.com/en/support/bulletin/2024/8/
CVE ID: CVE-2024-42036 State: PUBLISHED Published: 2024-08-08T09:28:19.295Z Last Updated: 2025-09-18T06:43:45.595Z Severity: LOW (CVSS 2.5 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: Huawei Products: HarmonyOS, EMUI Problem Types: CWE-285 Description: Access permission verification vulnerability in the Notepad module Impact: Successful exploitation of this vulnerability may affect service confidentiality. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://consumer.huawei.com/en/support/bulletin/2024/8/
CVE ID: CVE-2024-42037 State: PUBLISHED Published: 2024-08-08T09:30:18.428Z Last Updated: 2024-08-09T18:03:49.921Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Huawei Products: HarmonyOS, EMUI Problem Types: CWE-248 Description: Vulnerability of uncaught exceptions in the Graphics module Impact: Successful exploitation of this vulnerability may affect service confidentiality. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://https://consumer.huawei.com/en/support/bulletin/2024/8/
CVE ID: CVE-2024-42038 State: PUBLISHED Published: 2024-08-08T09:31:40.594Z Last Updated: 2025-09-18T06:34:28.868Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Huawei Products: HarmonyOS, EMUI Problem Types: CWE-287 Description: Vulnerability of PIN enhancement failures in the screen lock module Impact: Successful exploitation of this vulnerability may affect service confidentiality, integrity, and availability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://consumer.huawei.com/en/support/bulletin/2024/8/
CVE ID: CVE-2024-42039 State: PUBLISHED Published: 2024-09-04T01:35:23.145Z Last Updated: 2025-09-18T06:35:08.359Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: Huawei Products: HarmonyOS, EMUI Problem Types: CWE-285 Description: Access control vulnerability in the SystemUI module Impact: Successful exploitation of this vulnerability may affect service confidentiality. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://consumer.huawei.com/en/support/bulletin/2024/9/
CVE ID: CVE-2024-42040 State: PUBLISHED Published: 2024-08-23T00:00:00 Last Updated: 2024-11-20T16:22:55.745Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer Overflow vulnerability in the net/bootp.c in DENEX U-Boot from its initial commit in 2002 (3861aa5) up to today on any platform allows an attacker on the local network to leak memory from four up to 32 bytes of memory stored behind the packet to the network depending on the later use of DHCP-provided parameters via crafted DHCP responses. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/u-boot/u-boot/tags - https://www.schutzwerk.com/advisories/SCHUTZWERK-SA-2
ulnrichment: References: - https://github.com/u-boot/u-boot/tags - https://www.schutzwerk.com/advisories/SCHUTZWERK-SA-2024-004.txt
CVE ID: CVE-2024-42041 State: PUBLISHED Published: 2024-10-30T00:00:00 Last Updated: 2024-10-31T14:40:57.013Z Vendors: n/a Products: n/a Problem Types: n/a Description: The com.videodownload.browser.videodownloader (aka AppTool-Browser-Video All Video Downloader) application 20-30.05.24 for Android allows an attacker to execute arbitrary JavaScript code via the acr.browser.lightning.DefaultBrowserActivity component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/actuator/com.videodownload.browser.videodownloader/blob/main/CVE-2024-42041
CVE ID: CVE-2024-42048 State: PUBLISHED Published: 2025-08-07T00:00:00.000Z Last Updated: 2025-08-29T19:35:04.557Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenOrange Business Framework version 1.15.5 installs to a directory with overly permissive access control, allowing all authenticated users to write to the installation path. In combination with the application's behavior of loading DLLs from this location, this allows for DLL hijacking and may result in arbitrary code execution and privilege escalation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.microsoft.com/en-us/windows/win32/dlls/dynamic-link-library-search-order - https://support
t: References: - https://docs.microsoft.com/en-us/windows/win32/dlls/dynamic-link-library-search-order - https://support.microsoft.com/en-us/topic/secure-loading-of-libraries-to-prevent-dll-preloading-attacks-d41303ec-0748-9211-f317-2edc819682e1 - https://resources.infosecinstitute.com/topic/dll-hijacking - https://attack.mitre.org/techniques/T1574/001 - https://docs.microsoft.com/en-us/windows/win32/api/libloaderapi/nf-libloaderapi-loadlibrarya - https://docs.microsoft.com/en-us/windows/win32/api/libloaderapi/nf-libloaderapi-loadlibraryexa - https://www.openorange.com - https://landings.openorange.com/l/erp-peru-a.html - https://raw.githubusercontent.com/securityadvisories/Security-Advisori
tps://landings.openorange.com/l/erp-peru-a.html - https://raw.githubusercontent.com/securityadvisories/Security-Advisories/refs/heads/main/Advisories/Blaze%20Information%20Security%20-%20DLL%20Hijacking%20in%20OpenOrange%20Business%20Framework%20Allows%20Arbitrary%20Code%20Execution%20and%20Potential%20Privilege%20Escalation.txt
CVE ID: CVE-2024-42049 State: PUBLISHED Published: 2024-07-28T00:00:00 Last Updated: 2024-08-02T04:54:32.096Z Vendors: n/a Products: n/a Problem Types: n/a Description: TightVNC (Server for Windows) before 2.8.84 allows attackers to connect to the control pipe via a network connection. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.tightvnc.com/whatsnew.php - https://sourceforge.net/p/vnc-tight/bugs/1629/
CVE ID: CVE-2024-42050 State: PUBLISHED Published: 2024-07-28T00:00:00 Last Updated: 2024-08-02T04:54:31.341Z Severity: HIGH (CVSS 7 CVSS:3.1/AC:H/AV:L/A:H/C:H/I:H/PR:L/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: The MSI installer for Splashtop Streamer for Windows before 3.7.0.0 uses a temporary folder with weak permissions during installation. A local user can exploit this to escalate privileges to SYSTEM via an oplock on CredProvider_Inst.reg. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/SpacePlant/Vulns/blob/main/Advisories/2024/4.md - https://support-splashtopbusiness.splashtop.com/hc/en-us/articles
.com/SpacePlant/Vulns/blob/main/Advisories/2024/4.md - https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/25584410412571--Splashtop-Streamer-version-v3-7-0-0-for-Windows-released
CVE ID: CVE-2024-42051 State: PUBLISHED Published: 2024-07-28T00:00:00 Last Updated: 2024-08-02T04:54:31.342Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AC:L/AV:L/A:H/C:H/I:H/PR:L/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: The MSI installer for Splashtop Streamer for Windows before 3.6.2.0 uses a temporary folder with weak permissions during installation. A local user can exploit this to escalate privileges to SYSTEM by replacing InstRegExp.reg. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/SpacePlant/Vulns/blob/main/Advisories/2024/3.md - https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/20716875
ePlant/Vulns/blob/main/Advisories/2024/3.md - https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/20716875636763-Splashtop-Streamer-version-v3-6-2-0-for-Windows-released
CVE ID: CVE-2024-42052 State: PUBLISHED Published: 2024-07-28T00:00:00.000Z Last Updated: 2025-03-20T19:04:35.893Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AC:L/AV:L/A:H/C:H/I:H/PR:L/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: The MSI installer for Splashtop Streamer for Windows before 3.5.8.0 uses a temporary folder with weak permissions during installation. A local user can exploit this to escalate privileges to SYSTEM by placing a wevtutil.exe file in the folder. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/SpacePlant/Vulns/blob/main/Advisories/2024/1.md - https://support-splashtopbusiness.splashtop.com/hc/e
ttps://github.com/SpacePlant/Vulns/blob/main/Advisories/2024/1.md - https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/15813655496603-Splashtop-Streamer-version-v3-5-8-0-for-Windows-released
CVE ID: CVE-2024-42053 State: PUBLISHED Published: 2024-07-28T00:00:00 Last Updated: 2024-08-02T04:54:31.346Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AC:L/AV:L/A:H/C:H/I:H/PR:L/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: The MSI installer for Splashtop Streamer for Windows before 3.6.0.0 uses a temporary folder with weak permissions during installation. A local user can exploit this to escalate privileges to SYSTEM by placing a version.dll file in the folder. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/SpacePlant/Vulns/blob/main/Advisories/2024/2.md - https://support-splashtopbusiness.splashtop.com/hc/en-us/a
/github.com/SpacePlant/Vulns/blob/main/Advisories/2024/2.md - https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/18223802896539-Splashtop-Streamer-version-v3-6-0-0-for-Windows-released
CVE ID: CVE-2024-42054 State: PUBLISHED Published: 2024-07-28T00:00:00 Last Updated: 2024-10-28T20:20:52.173Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cervantes through 0.5-alpha accepts insecure file uploads. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.getastra.com/blog/vulnerability/xss-insecure-file-cervantes/ - https://www.jinsonvarghese.com/stored-xss-file-upload-vulnerabilities-found-in-cervantes/ - https://github.com/CervantesSec/cervantes/commit/78631a034d0fb3323a53fb7428b2022b29a0d2cd
CVE ID: CVE-2024-42055 State: PUBLISHED Published: 2024-07-28T00:00:00 Last Updated: 2024-10-27T14:33:30.610Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cervantes through 0.5-alpha allows stored XSS. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.getastra.com/blog/vulnerability/xss-insecure-file-cervantes/ - https://www.jinsonvarghese.com/stored-xss-file-upload-vulnerabilities-found-in-cervantes/ - https://github.com/CervantesSec/cervantes/commit/78631a034d0fb3323a53fb7428b2022b29a0d2cd
CVE ID: CVE-2024-42056 State: PUBLISHED Published: 2024-08-22T00:00:00.000Z Last Updated: 2025-03-13T18:02:12.917Z Vendors: n/a Products: n/a Problem Types: n/a Description: Retool (self-hosted enterprise) through 3.40.0 inserts resource authentication credentials into sent data. Credentials for users with "Use" permissions can be discovered (by an authenticated attacker) via the /api/resources endpoint. The earliest affected version is 3.18.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.retool.com/releases - https://docs.retool.com/disclosures/cve-2024-42056
CVE ID: CVE-2024-42057 State: PUBLISHED Published: 2024-09-03T01:43:28.106Z Last Updated: 2024-09-03T13:54:39.611Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Zyxel Products: ATP series firmware, USG FLEX series firmware, USG FLEX 50(W) series firmware, USG20(W)-VPN series firmware Problem Types: CWE-78 Description: A command injection vulnerability in the IPSec VPN feature of Zyxel ATP series firmware versions from V4.32 through V5.38, USG FLEX series firmware versions from V4.50 through V5.38, USG FLEX 50(W) series firmware versions from V4.16 through V5.38, and USG20(W)-VPN series firmware versions from V4.16 through V5.38 could allow an unauthenticated
m V4.16 through V5.38, and USG20(W)-VPN series firmware versions from V4.16 through V5.38 could allow an unauthenticated attacker to execute some OS commands on an affected device by sending a crafted username to the vulnerable device. Note that this attack could be successful only if the device was configured in User-Based-PSK authentication mode and a valid user with a long username exceeding 28 characters exists. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-09-03-2024
CVE ID: CVE-2024-42058 State: PUBLISHED Published: 2024-09-03T01:47:29.258Z Last Updated: 2024-09-03T13:54:13.924Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Zyxel Products: ATP series firmware, USG FLEX series firmware, USG FLEX 50(W) series firmware, USG20(W)-VPN series firmware Problem Types: CWE-476 Description: A null pointer dereference vulnerability in Zyxel ATP series firmware versions from V4.32 through V5.38, USG FLEX series firmware versions from V4.50 through V5.38, USG FLEX 50(W) series firmware versions from V5.20 through V5.38, and USG20(W)-VPN series firmware versions from V5.20 through V5.38 could allow an unauthenticated attacker to caus
5.38, and USG20(W)-VPN series firmware versions from V5.20 through V5.38 could allow an unauthenticated attacker to cause DoS conditions by sending crafted packets to a vulnerable device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-09-03-2024
CVE ID: CVE-2024-42059 State: PUBLISHED Published: 2024-09-03T01:51:20.796Z Last Updated: 2024-09-03T13:53:11.888Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Zyxel Products: ATP series firmware, USG FLEX series firmware, USG FLEX 50(W) series firmware, USG20(W)-VPN series firmware Problem Types: CWE-78 Description: A post-authentication command injection vulnerability in Zyxel ATP series firmware versions from V5.00 through V5.38, USG FLEX series firmware versions from V5.00 through V5.38, USG FLEX 50(W) series firmware versions from V5.00 through V5.38, and USG20(W)-VPN series firmware versions from V5.00 through V5.38 could allow an authenticated attack
00 through V5.38, and USG20(W)-VPN series firmware versions from V5.00 through V5.38 could allow an authenticated attacker with administrator privileges to execute some OS commands on an affected device by uploading a crafted compressed language file via FTP. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-09-03-2024
CVE ID: CVE-2024-42060 State: PUBLISHED Published: 2024-09-03T01:54:57.221Z Last Updated: 2024-09-03T13:43:44.353Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Zyxel Products: ATP series firmware, USG FLEX series firmware, USG FLEX 50(W) series firmware, USG20(W)-VPN series firmware Problem Types: CWE-78 Description: A post-authentication command injection vulnerability in Zyxel ATP series firmware versions from V4.32 through V5.38, USG FLEX series firmware versions from V4.50 through V5.38, USG FLEX 50(W) series firmware versions from V4.16 through V5.38, and USG20(W)-VPN series firmware versions from V4.16 through V5.38 could allow an authenticated attack
16 through V5.38, and USG20(W)-VPN series firmware versions from V4.16 through V5.38 could allow an authenticated attacker with administrator privileges to execute some OS commands on an affected device by uploading a crafted internal user agreement file to the vulnerable device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-09-03-2024
CVE ID: CVE-2024-42061 State: PUBLISHED Published: 2024-09-03T01:59:36.884Z Last Updated: 2024-09-03T13:48:38.734Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Zyxel Products: ATP series firmware, USG FLEX series firmware, USG FLEX 50(W) series firmware, USG20(W)-VPN series firmware Problem Types: CWE-79 Description: A reflected cross-site scripting (XSS) vulnerability in the CGI program "dynamic_script.cgi" of Zyxel ATP series firmware versions from V4.32 through V5.38, USG FLEX series firmware versions from V4.50 through V5.38, USG FLEX 50(W) series firmware versions from V4.16 through V5.38, and USG20(W)-VPN series firmware versions from V4.16 through
X 50(W) series firmware versions from V4.16 through V5.38, and USG20(W)-VPN series firmware versions from V4.16 through V5.38 could allow an attacker to trick a user into visiting a crafted URL with the XSS payload. The attacker could obtain browser-based information if the malicious script is executed on the victim’s browser. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-09-03-2024