Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ity. Exploitation of this issue does not require user interaction. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/magento/apsb24-73.html
CVE ID: CVE-2024-45129 State: PUBLISHED Published: 2024-10-10T09:57:51.997Z Last Updated: 2024-10-10T14:25:15.306Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Adobe Products: Adobe Commerce Problem Types: CWE-284 Description: Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Access Control vulnerability that could result in Privilege escalation. A low-privileged attacker could leverage this vulnerability to bypass security measures and have a low impact on integrity. Exploitation of this issue does not require user interaction. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://h
this issue does not require user interaction. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/magento/apsb24-73.html
CVE ID: CVE-2024-45130 State: PUBLISHED Published: 2024-10-10T09:57:55.895Z Last Updated: 2024-10-10T14:01:43.666Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Adobe Products: Adobe Commerce Problem Types: CWE-284 Description: Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and have a low impact on integrity. Exploitation of this issue does not require user interaction. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http
CVE ID: CVE-2024-45131 State: PUBLISHED Published: 2024-10-10T09:57:54.346Z Last Updated: 2024-10-14T10:39:03.439Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: Adobe Products: Adobe Commerce Problem Types: CWE-863 Description: Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and have a low impact on confidentiality and integrity. Exploitation of this issue does not require user interaction. Additional Analyst Notes: - CISA ADP Vulnrichment:
egrity. Exploitation of this issue does not require user interaction. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/magento/apsb24-73.html
CVE ID: CVE-2024-45132 State: PUBLISHED Published: 2024-10-10T09:57:55.112Z Last Updated: 2024-10-14T10:37:42.897Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Adobe Products: Adobe Commerce Problem Types: CWE-863 Description: Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Authorization vulnerability that could result in Privilege escalation. A low-privileged attacker could leverage this vulnerability to bypass security measures and affect confidentiality. Exploitation of this issue does not require user interaction. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adob
CVE ID: CVE-2024-45133 State: PUBLISHED Published: 2024-10-10T09:58:04.630Z Last Updated: 2024-10-10T14:19:56.423Z Severity: LOW (CVSS 2.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N) Vendors: Adobe Products: Adobe Commerce Problem Types: CWE-284 Description: Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Information Exposure vulnerability that could result in a security feature bypass. An admin attacker could leverage this vulnerability to have a low impact on confidentiality which may aid in further attacks. Exploitation of this issue does not require user interaction. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://
CVE ID: CVE-2024-45134 State: PUBLISHED Published: 2024-10-10T09:57:52.772Z Last Updated: 2024-10-10T14:05:32.033Z Severity: LOW (CVSS 2.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N) Vendors: Adobe Products: Adobe Commerce Problem Types: CWE-200 Description: Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Information Exposure vulnerability that could result in a security feature bypass. An admin attacker could leverage this vulnerability to have a low impact on confidentiality which may aid in further attacks. Exploitation of this issue does not require user interaction. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://
CVE ID: CVE-2024-45135 State: PUBLISHED Published: 2024-10-10T09:57:57.455Z Last Updated: 2024-10-10T14:00:45.112Z Severity: LOW (CVSS 2.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N) Vendors: Adobe Products: Adobe Commerce Problem Types: CWE-284 Description: Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An admin attacker could leverage this vulnerability to bypass security measures and have a low impact on integrity. Exploitation of this issue does not require user interaction. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.a
ssue does not require user interaction. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/magento/apsb24-73.html
CVE ID: CVE-2024-45136 State: PUBLISHED Published: 2024-10-09T14:05:03.366Z Last Updated: 2024-10-09T14:37:20.156Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: InCopy Problem Types: CWE-434 Description: InCopy versions 19.4, 18.5.3 and earlier are affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution by an attacker. An attacker could exploit this vulnerability by uploading a malicious file which can then be executed on the server. Exploitation of this issue requires user interaction. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/se
e requires user interaction. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/incopy/apsb24-79.html
CVE ID: CVE-2024-45137 State: PUBLISHED Published: 2024-10-09T14:18:39.512Z Last Updated: 2024-10-09T16:04:13.405Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: InDesign Desktop Problem Types: CWE-434 Description: InDesign Desktop versions 19.4, 18.5.3 and earlier are affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution. An attacker could exploit this vulnerability by uploading a malicious file which, when executed, could run arbitrary code in the context of the server. Exploitation of this issue requires user interaction. Additional Analyst Notes: - CISA ADP Vulnrichment:
of the server. Exploitation of this issue requires user interaction. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/incopy/apsb24-79.html
CVE ID: CVE-2024-45138 State: PUBLISHED Published: 2024-10-09T13:28:45.937Z Last Updated: 2024-10-09T15:56:01.678Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Substance3D - Stager Problem Types: CWE-416 Description: Substance3D - Stager versions 3.0.3 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/substance3d_stager/apsb24-81.html
CVE ID: CVE-2024-45139 State: PUBLISHED Published: 2024-10-09T13:28:42.096Z Last Updated: 2024-10-09T13:42:58.122Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Substance3D - Stager Problem Types: CWE-122 Description: Substance3D - Stager versions 3.0.3 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/substance3d_stager/apsb24-81.html
CVE ID: CVE-2024-45140 State: PUBLISHED Published: 2024-10-09T13:28:41.250Z Last Updated: 2024-10-09T13:39:11.331Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Substance3D - Stager Problem Types: CWE-787 Description: Substance3D - Stager versions 3.0.3 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/substance3d_stager/apsb24-81.html
CVE ID: CVE-2024-45141 State: PUBLISHED Published: 2024-10-09T13:28:43.640Z Last Updated: 2024-10-09T17:41:32.867Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Substance3D - Stager Problem Types: CWE-787 Description: Substance3D - Stager versions 3.0.3 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/substance3d_stager/apsb24-81.html
CVE ID: CVE-2024-45142 State: PUBLISHED Published: 2024-10-09T13:28:45.183Z Last Updated: 2024-10-09T17:29:06.772Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Substance3D - Stager Problem Types: CWE-123 Description: Substance3D - Stager versions 3.0.3 and earlier are affected by a Write-what-where Condition vulnerability that could allow an attacker to execute arbitrary code in the context of the current user. This vulnerability allows an attacker to write a controlled value to an arbitrary memory location, potentially leading to code execution. Exploitation of this issue requires user interaction in that a victim must open a malicious file
ding to code execution. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/substance3d_stager/apsb24-81.html
CVE ID: CVE-2024-45143 State: PUBLISHED Published: 2024-10-09T13:28:44.409Z Last Updated: 2024-10-09T17:31:08.870Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Substance3D - Stager Problem Types: CWE-122 Description: Substance3D - Stager versions 3.0.3 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/substance3d_stager/apsb24-81.html
CVE ID: CVE-2024-45144 State: PUBLISHED Published: 2024-10-09T13:28:40.433Z Last Updated: 2024-10-09T13:41:02.067Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Substance3D - Stager Problem Types: CWE-787 Description: Substance3D - Stager versions 3.0.3 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/substance3d_stager/apsb24-81.html
CVE ID: CVE-2024-45145 State: PUBLISHED Published: 2024-10-09T09:42:08.760Z Last Updated: 2024-10-09T13:19:21.497Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: Adobe Products: Lightroom Desktop Problem Types: CWE-125 Description: Lightroom Desktop versions 7.4.1, 13.5, 12.5.1 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/se
must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/lightroom/apsb24-78.html
CVE ID: CVE-2024-45146 State: PUBLISHED Published: 2024-10-09T08:51:18.644Z Last Updated: 2024-10-09T12:41:02.596Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Dimension Problem Types: CWE-416 Description: Dimension versions 4.0.3 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/dimension/apsb24-74.html
CVE ID: CVE-2024-45147 State: PUBLISHED Published: 2024-11-12T18:44:17.716Z Last Updated: 2024-11-12T19:53:34.320Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: Adobe Products: Bridge Problem Types: CWE-125 Description: Bridge versions 13.0.9, 14.1.2 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/bridge/apsb
. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/bridge/apsb24-77.html
CVE ID: CVE-2024-45148 State: PUBLISHED Published: 2024-10-10T09:57:53.566Z Last Updated: 2024-10-10T14:04:54.106Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Adobe Commerce Problem Types: CWE-287 Description: Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Authentication vulnerability that could result in a security feature bypass. A low-privileged attacker could leverage this vulnerability to gain unauthorized access without proper credentials. Exploitation of this issue does not require user interaction. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.
issue does not require user interaction. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/magento/apsb24-73.html
CVE ID: CVE-2024-45149 State: PUBLISHED Published: 2024-10-10T09:57:50.452Z Last Updated: 2024-12-12T17:38:26.517Z Severity: LOW (CVSS 2.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N) Vendors: Adobe Products: Adobe Commerce Problem Types: CWE-284 Description: Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. A high-privileged attacker could leverage this vulnerability to bypass security measures and have a low impact on confidentiality. Exploitation of this issue does not require user interaction. Additional Analyst Notes: - CISA ADP Vulnrichment: References: -
ation of this issue does not require user interaction. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/magento/apsb24-73.html
CVE ID: CVE-2024-45150 State: PUBLISHED Published: 2024-10-09T08:51:17.822Z Last Updated: 2024-10-09T12:41:09.759Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Dimension Problem Types: CWE-787 Description: Dimension versions 4.0.3 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/dimension/apsb24-74.html
CVE ID: CVE-2024-45152 State: PUBLISHED Published: 2024-10-09T13:28:42.865Z Last Updated: 2024-10-09T17:49:28.114Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Substance3D - Stager Problem Types: CWE-787 Description: Substance3D - Stager versions 3.0.3 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/substance3d_stager/apsb24-81.html
CVE ID: CVE-2024-45153 State: PUBLISHED Published: 2024-10-07T12:14:34.260Z Last Updated: 2024-10-07T13:27:12.167Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Adobe Products: Adobe Experience Manager Problem Types: CWE-79 Description: Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.a
e page containing the vulnerable field. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/experience-manager/apsb24-28.html
CVE ID: CVE-2024-45155 State: PUBLISHED Published: 2024-12-10T20:27:49.222Z Last Updated: 2024-12-17T04:55:40.892Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Animate Problem Types: CWE-824 Description: Animate versions 23.0.8, 24.0.5 and earlier are affected by an Access of Uninitialized Pointer vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/animate/apsb24-96.html
CVE ID: CVE-2024-45156 State: PUBLISHED Published: 2024-12-10T20:27:47.634Z Last Updated: 2024-12-17T04:55:42.117Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Animate Problem Types: CWE-476 Description: Animate versions 23.0.8, 24.0.5 and earlier are affected by a NULL Pointer Dereference vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/animate/apsb24-96.html
CVE ID: CVE-2024-45157 State: PUBLISHED Published: 2024-09-05T00:00:00.000Z Last Updated: 2025-03-14T16:22:12.090Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Mbed TLS before 2.28.9 and 3.x before 3.6.1, in which the user-selected algorithm is not used. Unlike previously documented, enabling MBEDTLS_PSA_HMAC_DRBG_MD_TYPE does not cause the PSA subsystem to use HMAC_DRBG: it uses HMAC_DRBG only when MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG and MBEDTLS_CTR_DRBG_C are disabled. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mbed-tls.readthedocs.io/en/latest/security-advisories/ - https://github.com/Mbed-TLS/mbedtls/releases/ - https://m
tps://mbed-tls.readthedocs.io/en/latest/security-advisories/ - https://github.com/Mbed-TLS/mbedtls/releases/ - https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2024-08-1/
CVE ID: CVE-2024-45158 State: PUBLISHED Published: 2024-09-05T00:00:00 Last Updated: 2024-11-25T20:54:01.597Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Mbed TLS 3.6 before 3.6.1. A stack buffer overflow in mbedtls_ecdsa_der_to_raw() and mbedtls_ecdsa_raw_to_der() can occur when the bits parameter is larger than the largest supported curve. In some configurations with PSA disabled, all values of bits are affected. (This never happens in internal library calls, but can affect applications that call these functions directly.) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mbed-tls.readthedocs.io/en/latest/security-advisories/
nal Analyst Notes: - CISA ADP Vulnrichment: References: - https://mbed-tls.readthedocs.io/en/latest/security-advisories/ - https://github.com/Mbed-TLS/mbedtls/releases/ - https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2024-08-2/
CVE ID: CVE-2024-45159 State: PUBLISHED Published: 2024-09-05T00:00:00.000Z Last Updated: 2025-03-13T19:47:36.383Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Mbed TLS 3.x before 3.6.1. With TLS 1.3, when a server enables optional authentication of the client, if the client-provided certificate does not have appropriate values in if keyUsage or extKeyUsage extensions, then the return value of mbedtls_ssl_get_verify_result() would incorrectly have the MBEDTLS_X509_BADCERT_KEY_USAGE and MBEDTLS_X509_BADCERT_KEY_USAGE bits clear. As a result, an attacker that had a certificate valid for uses other than TLS client authentication would nonetheless be able
result, an attacker that had a certificate valid for uses other than TLS client authentication would nonetheless be able to use it for TLS client authentication. Only TLS 1.3 servers were affected, and only with optional authentication (with required authentication, the handshake would be aborted with a fatal alert). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mbed-tls.readthedocs.io/en/latest/security-advisories/ - https://github.com/Mbed-TLS/mbedtls/releases/ - https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2024-08-3/
CVE ID: CVE-2024-45160 State: PUBLISHED Published: 2024-10-09T00:00:00 Last Updated: 2024-10-09T20:50:54.566Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect credential validation in LemonLDAP::NG 2.18.x and 2.19.x before 2.19.2 allows attackers to bypass OAuth2 client authentication via an empty client_password parameter (client secret). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/tags - https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/issues/3223 - https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/commit/06d771cbc2d5c752354c50f83e4912e5879f9aa2 - https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/
ap-ng/lemonldap-ng/-/commit/06d771cbc2d5c752354c50f83e4912e5879f9aa2 - https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/commit/236cdfe42c1dc04a15a4a40c5e6a8c2e858d71d7 - https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/commit/696f49a0855faeb271096dccb8381e2129687c3d