Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-47529 State: PUBLISHED Published: 2024-10-02T19:17:21.668Z Last Updated: 2024-10-31T13:52:49.907Z Vendors: OpenC3 Products: cosmos Problem Types: CWE-312 Description: OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. OpenC3 COSMOS stores the password of a user unencrypted in the LocalStorage of a web browser. This makes the user password susceptible to exfiltration via Cross-site scripting (see GHSL-2024-128). This vulnerability is fixed in 5.19.0. This only affects Open Source edition, and not OpenC3 COSMOS Enterprise Edition. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github
nd not OpenC3 COSMOS Enterprise Edition. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/OpenC3/cosmos/security/advisories/GHSA-4xqv-47rm-37mm - https://github.com/OpenC3/cosmos/commit/b5ab34fe7fa54c0c8171c4aa3caf4e03d6f63bd7 - https://securitylab.github.com/advisories/GHSL-2024-127_GHSL-2024-129_OpenC3_COSMOS
CVE ID: CVE-2024-47530 State: PUBLISHED Published: 2024-09-30T15:17:39.731Z Last Updated: 2024-09-30T15:45:37.010Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: Clinical-Genomics Products: scout Problem Types: CWE-601 Description: Scout is a web-based visualizer for VCF-files. Open redirect vulnerability allows performing phishing attacks on users by redirecting them to malicious page. /login API endpoint is vulnerable to open redirect attack via next parameter due to absence of sanitization logic. Additionally, due to lack of scheme validation, HTTPS Downgrade Attack can be performed on the users. This vulnerability is fixed in 4.89. Additional Analyst No
dation, HTTPS Downgrade Attack can be performed on the users. This vulnerability is fixed in 4.89. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Clinical-Genomics/scout/security/advisories/GHSA-3x45-2m34-x95v - https://github.com/Clinical-Genomics/scout/commit/50055edfca9a7183b248019af97e1fb0b0065a02
CVE ID: CVE-2024-47531 State: PUBLISHED Published: 2024-09-30T15:26:49.421Z Last Updated: 2024-09-30T16:31:07.889Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: Clinical-Genomics Products: scout Problem Types: CWE-116 Description: Scout is a web-based visualizer for VCF-files. Due to the lack of sanitization in the filename, it is possible bypass intended file extension and make users download malicious files with any extension. With malicious content injected inside the file data and users unknowingly downloading it and opening may lead to the compromise of users' devices or data. This vulnerability is fixed in 4.89. Additional Analyst Notes: - CISA ADP V
to the compromise of users' devices or data. This vulnerability is fixed in 4.89. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Clinical-Genomics/scout/security/advisories/GHSA-24xv-q29v-3h6r - https://github.com/Clinical-Genomics/scout/commit/f59e50f8ea596e641da8a0e9c7a33c0696bcbea5
CVE ID: CVE-2024-47532 State: PUBLISHED Published: 2024-09-30T15:29:57.907Z Last Updated: 2024-09-30T17:29:29.522Z Vendors: zopefoundation Products: RestrictedPython Problem Types: CWE-200 Description: RestrictedPython is a restricted execution environment for Python to run untrusted code. A user can gain access to protected (and potentially sensible) information indirectly via AttributeError.obj and the string module. The problem will be fixed in version 7.3. As a workaround, If the application does not require access to the module string, it can remove it from RestrictedPython.Utilities.utility_builtins or otherwise do not make it available in the restricted execution environment. Addition
ython.Utilities.utility_builtins or otherwise do not make it available in the restricted execution environment. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/zopefoundation/RestrictedPython/security/advisories/GHSA-5rfv-66g4-jr8h - https://github.com/zopefoundation/RestrictedPython/commit/d701cc36cccac36b21fa200f1f2d1945a9a215e6
CVE ID: CVE-2024-47533 State: PUBLISHED Published: 2024-11-18T16:33:55.229Z Last Updated: 2024-11-18T18:24:07.378Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: cobbler Products: cobbler Problem Types: CWE-287 Description: Cobbler, a Linux installation server that allows for rapid setup of network installation environments, has an improper authentication vulnerability starting in version 3.0.0 and prior to versions 3.2.3 and 3.3.7. `utils.get_shared_secret()` always returns `-1`, which allows anyone to connect to cobbler XML-RPC as user `''` password `-1` and make any changes. This gives anyone with network access to a cobbler server full control of the
`''` password `-1` and make any changes. This gives anyone with network access to a cobbler server full control of the server. Versions 3.2.3 and 3.3.7 fix the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/cobbler/cobbler/security/advisories/GHSA-m26c-fcgh-cp6h - https://github.com/cobbler/cobbler/commit/32c5cada013dc8daa7320a8eda9932c2814742b0 - https://github.com/cobbler/cobbler/commit/e19717623c10b29e7466ed4ab23515a94beb2dda
CVE ID: CVE-2024-47534 State: PUBLISHED Published: 2024-10-01T15:17:47.363Z Last Updated: 2024-11-21T16:56:38.062Z Vendors: theupdateframework Products: go-tuf Problem Types: CWE-362 Description: go-tuf is a Go implementation of The Update Framework (TUF). The go-tuf client inconsistently traces the delegations. For example, if targets delegate to "A", and to "B", and "B" delegates to "C", then the client should trace the delegations in the order "A" then "B" then "C" but it may incorrectly trace the delegations "B"->"C"->"A". This vulnerability is fixed in 2.0.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/theupdateframework/go-tuf/security/advisories
l Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/theupdateframework/go-tuf/security/advisories/GHSA-4f8r-qqr9-fq8j - https://github.com/theupdateframework/tuf-conformance/pull/115 - https://github.com/theupdateframework/go-tuf/commit/edc30b474f5afd4cc603e17149704d5aa605151d - https://github.com/theupdateframework/go-tuf/commit/f36420caba9edbfdfd64f95a9554c0836d9cf819 - https://github.com/theupdateframework/go-tuf/blob/f95222bdd22d2ac4e5b8ed6fe912b645e213c3b5/metadata/metadata.go#L565-L580
CVE ID: CVE-2024-47535 State: PUBLISHED Published: 2024-11-12T15:50:08.334Z Last Updated: 2024-11-13T20:44:41.743Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: netty Products: netty Problem Types: CWE-400 Description: Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. An unsafe reading of environment file could potentially cause a denial of service in Netty. When loaded on an Windows application, Netty attempts to load a file that does not exist. If an attacker creates such a large file, the Netty application crashes. This vulnerability is fixed in 4.1.115.
exist. If an attacker creates such a large file, the Netty application crashes. This vulnerability is fixed in 4.1.115. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/netty/netty/security/advisories/GHSA-xq3w-v528-46rv - https://github.com/netty/netty/commit/fbf7a704a82e7449b48bd0bbb679f5661c6d61a3
CVE ID: CVE-2024-47536 State: PUBLISHED Published: 2024-09-30T17:09:40.192Z Last Updated: 2024-09-30T17:25:48.104Z Vendors: StarCitizenTools Products: mediawiki-skins-Citizen Problem Types: CWE-80, CWE-79 Description: Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. A user with the editmyprivateinfo right or who can otherwise change their name can XSS themselves by setting their "real name" to an XSS payload. This vulnerability is fixed in 2.31.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/StarCitizenTools/mediawiki-skins-Citizen/security/advisories/GHSA-62r2-gcxr-426x - https://github.com/StarCitizenTools/mediawiki-s
nTools/mediawiki-skins-Citizen/security/advisories/GHSA-62r2-gcxr-426x - https://github.com/StarCitizenTools/mediawiki-skins-Citizen/commit/717d16af35b10dab04d434aefddbf991fc8c168c - https://github.com/StarCitizenTools/mediawiki-skins-Citizen/commit/86da3e07718c8d8da6f4310386fef85599606f9b - https://github.com/StarCitizenTools/mediawiki-skins-Citizen/blob/d45c3d69f30863f622f16eb40dd41d3ca943454a/includes/Components/CitizenComponentUserInfo.php#L137
CVE ID: CVE-2024-47537 State: PUBLISHED Published: 2024-12-11T18:51:56.158Z Last Updated: 2025-11-03T20:39:34.675Z Vendors: gstreamer Products: gstreamer Problem Types: CWE-787, CWE-190 Description: GStreamer is a library for constructing graphs of media-handling components. The program attempts to reallocate the memory pointed to by stream->samples to accommodate stream->n_samples + samples_count elements of type QtDemuxSample. The problem is that samples_count is read from the input file. And if this value is big enough, this can lead to an integer overflow during the addition. As a consequence, g_try_renew might allocate memory for a significantly smaller number of elements than intended.
ition. As a consequence, g_try_renew might allocate memory for a significantly smaller number of elements than intended. Following this, the program iterates through samples_count elements and attempts to write samples_count number of elements, potentially exceeding the actual allocated memory size and causing an OOB-write. This vulnerability is fixed in 1.24.10. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://securitylab.github.com/advisories/GHSL-2024-094_Gstreamer/ - https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8059.patch - https://gstreamer.freedesktop.org/security/sa-2024-0005.html
CVE ID: CVE-2024-47538 State: PUBLISHED Published: 2024-12-11T18:52:30.622Z Last Updated: 2025-11-03T22:20:14.196Z Vendors: gstreamer Products: gstreamer Problem Types: CWE-121 Description: GStreamer is a library for constructing graphs of media-handling components. A stack-buffer overflow has been detected in the `vorbis_handle_identification_packet` function within `gstvorbisdec.c`. The position array is a stack-allocated buffer of size 64. If vd->vi.channels exceeds 64, the for loop will write beyond the boundaries of the position array. The value written will always be `GST_AUDIO_CHANNEL_POSITION_NONE`. This vulnerability allows someone to overwrite the EIP address allocated in the stack
`GST_AUDIO_CHANNEL_POSITION_NONE`. This vulnerability allows someone to overwrite the EIP address allocated in the stack. Additionally, this bug can overwrite the `GstAudioInfo` info structure. This vulnerability is fixed in 1.24.10. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://securitylab.github.com/advisories/GHSL-2024-115_GHSL-2024-118_Gstreamer/ - https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8035.patch - https://gstreamer.freedesktop.org/security/sa-2024-0022.html
CVE ID: CVE-2024-47539 State: PUBLISHED Published: 2024-12-11T18:53:00.750Z Last Updated: 2025-11-03T20:39:36.090Z Vendors: gstreamer Products: gstreamer Problem Types: CWE-787 Description: GStreamer is a library for constructing graphs of media-handling components. An out-of-bounds write vulnerability was identified in the convert_to_s334_1a function in isomp4/qtdemux.c. The vulnerability arises due to a discrepancy between the size of memory allocated to the storage array and the loop condition i * 2 < ccpair_size. Specifically, when ccpair_size is even, the allocated size in storage does not match the loop's expected bounds, resulting in an out-of-bounds write. This bug allows for the ove
e in storage does not match the loop's expected bounds, resulting in an out-of-bounds write. This bug allows for the overwriting of up to 3 bytes beyond the allocated bounds of the storage array. This vulnerability is fixed in 1.24.10. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://securitylab.github.com/advisories/GHSL-2024-195_Gstreamer/ - https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8059.patch - https://gstreamer.freedesktop.org/security/sa-2024-0007.html
CVE ID: CVE-2024-47540 State: PUBLISHED Published: 2024-12-11T18:54:04.383Z Last Updated: 2025-11-03T20:39:37.616Z Vendors: gstreamer Products: gstreamer Problem Types: CWE-457 Description: GStreamer is a library for constructing graphs of media-handling components. An uninitialized stack variable vulnerability has been identified in the gst_matroska_demux_add_wvpk_header function within matroska-demux.c. When size < 4, the program calls gst_buffer_unmap with an uninitialized map variable. Then, in the gst_memory_unmap function, the program will attempt to unmap the buffer using the uninitialized map variable, causing a function pointer hijack, as it will jump to mem->allocator->mem_unmap_fu
using the uninitialized map variable, causing a function pointer hijack, as it will jump to mem->allocator->mem_unmap_full or mem->allocator->mem_unmap. This vulnerability could allow an attacker to hijack the execution flow, potentially leading to code execution. This vulnerability is fixed in 1.24.10. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://securitylab.github.com/advisories/GHSL-2024-197_GStreamer/ - https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8057.patch - https://gstreamer.freedesktop.org/security/sa-2024-0017.html
CVE ID: CVE-2024-47541 State: PUBLISHED Published: 2024-12-11T18:54:33.099Z Last Updated: 2025-11-03T22:20:15.648Z Vendors: gstreamer Products: gstreamer Problem Types: CWE-787 Description: GStreamer is a library for constructing graphs of media-handling components. An OOB-write vulnerability has been identified in the gst_ssa_parse_remove_override_codes function of the gstssaparse.c file. This function is responsible for parsing and removing SSA (SubStation Alpha) style override codes, which are enclosed in curly brackets ({}). The issue arises when a closing curly bracket "}" appears before an opening curly bracket "{" in the input string. In this case, memmove() incorrectly duplicates a s
"}" appears before an opening curly bracket "{" in the input string. In this case, memmove() incorrectly duplicates a substring. With each successive loop iteration, the size passed to memmove() becomes progressively larger (strlen(end+1)), leading to a write beyond the allocated memory bounds. This vulnerability is fixed in 1.24.10. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://securitylab.github.com/advisories/GHSL-2024-228_GStreamer/ - https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8036.patch - https://gstreamer.freedesktop.org/security/sa-2024-0023.html
CVE ID: CVE-2024-47542 State: PUBLISHED Published: 2024-12-11T18:55:18.069Z Last Updated: 2025-11-03T22:20:17.112Z Vendors: gstreamer Products: gstreamer Problem Types: CWE-476, CWE-125 Description: GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference has been discovered in the id3v2_read_synch_uint function, located in id3v2.c. If id3v2_read_synch_uint is called with a null work->hdr.frame_data, the pointer guint8 *data is accessed without validation, resulting in a null pointer dereference. This vulnerability can result in a Denial of Service (DoS) by triggering a segmentation fault (SEGV). This vulnerability is fixed in 1.24.10. Additiona
n a Denial of Service (DoS) by triggering a segmentation fault (SEGV). This vulnerability is fixed in 1.24.10. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://securitylab.github.com/advisories/GHSL-2024-235_Gstreamer/ - https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8033.patch - https://gstreamer.freedesktop.org/security/sa-2024-0008.html
CVE ID: CVE-2024-47543 State: PUBLISHED Published: 2024-12-11T18:55:50.210Z Last Updated: 2025-11-03T20:39:38.992Z Vendors: gstreamer Products: gstreamer Problem Types: CWE-125 Description: GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has been discovered in qtdemux_parse_container function within qtdemux.c. In the parent function qtdemux_parse_node, the value of length is not well checked. So, if length is big enough, it causes the pointer end to point beyond the boundaries of buffer. Subsequently, in the qtdemux_parse_container function, the while loop can trigger an OOB-read, accessing memory beyond the bounds of buf. This vulnerabi
se_container function, the while loop can trigger an OOB-read, accessing memory beyond the bounds of buf. This vulnerability can result in reading up to 4GB of process memory or potentially causing a segmentation fault (SEGV) when accessing invalid memory. This vulnerability is fixed in 1.24.10. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://securitylab.github.com/advisories/GHSL-2024-236_Gstreamer/ - https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8059.patch - https://gstreamer.freedesktop.org/security/sa-2024-0009.html
CVE ID: CVE-2024-47544 State: PUBLISHED Published: 2024-12-11T18:57:31.268Z Last Updated: 2025-11-03T20:39:40.368Z Vendors: gstreamer Products: gstreamer Problem Types: CWE-476 Description: GStreamer is a library for constructing graphs of media-handling components. The function qtdemux_parse_sbgp in qtdemux.c is affected by a null dereference vulnerability. This vulnerability is fixed in 1.24.10. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://securitylab.github.com/advisories/GHSL-2024-238_Gstreamer/ - https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8059.patch - https://gstreamer.freedesktop.org/security/sa-2024-0011.htm
esktop.org/gstreamer/gstreamer/-/merge_requests/8059.patch - https://gstreamer.freedesktop.org/security/sa-2024-0011.html
CVE ID: CVE-2024-47545 State: PUBLISHED Published: 2024-12-11T18:58:14.462Z Last Updated: 2025-11-03T20:39:41.770Z Vendors: gstreamer Products: gstreamer Problem Types: CWE-191 Description: GStreamer is a library for constructing graphs of media-handling components. An integer underflow has been detected in qtdemux_parse_trak function within qtdemux.c. During the strf parsing case, the subtraction size -= 40 can lead to a negative integer overflow if it is less than 40. If this happens, the subsequent call to gst_buffer_fill will invoke memcpy with a large tocopy size, resulting in an OOB-read. This vulnerability is fixed in 1.24.10. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE P
lting in an OOB-read. This vulnerability is fixed in 1.24.10. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://securitylab.github.com/advisories/GHSL-2024-242_Gstreamer/ - https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8059.patch - https://gstreamer.freedesktop.org/security/sa-2024-0010.html
CVE ID: CVE-2024-47546 State: PUBLISHED Published: 2024-12-11T19:01:05.831Z Last Updated: 2025-11-03T20:39:43.177Z Vendors: gstreamer Products: gstreamer Problem Types: CWE-191 Description: GStreamer is a library for constructing graphs of media-handling components. An integer underflow has been detected in extract_cc_from_data function within qtdemux.c. In the FOURCC_c708 case, the subtraction atom_length - 8 may result in an underflow if atom_length is less than 8. When that subtraction underflows, *cclen ends up being a large number, and then cclen is passed to g_memdup2 leading to an out-of-bounds (OOB) read. This vulnerability is fixed in 1.24.10. Additional Analyst Notes: - CISA ADP Vu
leading to an out-of-bounds (OOB) read. This vulnerability is fixed in 1.24.10. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://securitylab.github.com/advisories/GHSL-2024-243_Gstreamer/ - https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8059.patch - https://gstreamer.freedesktop.org/security/sa-2024-0013.html
CVE ID: CVE-2024-47547 State: PUBLISHED Published: 2024-12-06T18:00:24.657Z Last Updated: 2024-12-06T20:41:43.823Z Severity: CRITICAL (CVSS 9.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L) Vendors: Ruijie Products: Reyee OS Problem Types: CWE-640 Description: Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x contains a weak mechanism for its users to change their passwords which leaves authentication vulnerable to brute force attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-338-01
CVE ID: CVE-2024-47549 State: PUBLISHED Published: 2024-10-25T06:18:42.287Z Last Updated: 2024-10-25T18:32:25.798Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N) Vendors: Sharp Corporation, Toshiba Tec Corporation Products: Sharp Digital Full-color MFPs and Monochrome MFPs, e-STUDIO 908, e-STUDIO 1058, e-STUDIO 1208 Problem Types: CWE-644 Description: Sharp and Toshiba Tec MFPs improperly process query parameters in HTTP requests, which may allow contamination of unintended data to HTTP response headers. Accessing a crafted URL which points to an affected product may cause malicious script executed on the web browser. Additional Analyst Notes: - CISA ADP Vulnrichment:
ected product may cause malicious script executed on the web browser. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://jvn.jp/en/vu/JVNVU95063136/ - https://global.sharp/products/copier/info/info_security_2024-10.html - https://www.toshibatec.com/information/20241025_01.html
CVE ID: CVE-2024-47550 State: PUBLISHED Published: 2025-05-13T21:03:18.416Z Last Updated: 2025-05-14T17:12:14.385Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: Endurance Gaming Mode software installers Problem Types: Escalation of Privilege, CWE-276 Description: Incorrect default permissions for some Endurance Gaming Mode software installers may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01254.html
CVE ID: CVE-2024-47552 State: PUBLISHED Published: 2025-03-20T08:58:01.495Z Last Updated: 2025-03-24T14:45:20.117Z Vendors: Apache Software Foundation Products: Apache Seata (incubating) Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in Apache Seata (incubating). This issue affects Apache Seata (incubating): from 2.0.0 before 2.2.0. Users are recommended to upgrade to version 2.2.0, which fixes the issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/652o82vzk9qrtgksk55cfgpbvdgtkch0
CVE ID: CVE-2024-47553 State: PUBLISHED Published: 2024-10-08T08:40:50.371Z Last Updated: 2024-10-08T16:37:31.430Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: Siemens SINEC Security Monitor Problem Types: CWE-88 Description: A vulnerability has been identified in Siemens SINEC Security Monitor (All versions < V4.9.0). The affected application does not properly validate user input to the ```ssmctl-client``` command. This could allow an authenticated, lowly privileged remote attacker to execute arbitrary code with root privileges on the underlying OS. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https:/
code with root privileges on the underlying OS. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-430425.html