Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-45695 State: PUBLISHED Published: 2024-09-16T06:37:59.375Z Last Updated: 2024-09-16T13:45:32.142Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: D-Link Products: DIR-X4860 A1 Problem Types: CWE-121 Description: The web service of certain models of D-Link wireless routers contains a Stack-based Buffer Overflow vulnerability, which allows unauthenticated remote attackers to exploit this vulnerability to execute arbitrary code on the device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-8082-f1687-1.html - https://www.twcert.org.tw/en/cp-139-8083-a299e-2.html
CVE ID: CVE-2024-45696 State: PUBLISHED Published: 2024-09-16T06:45:52.996Z Last Updated: 2024-09-16T13:44:11.444Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: D-Link Products: DIR-X4860 A1, COVR-X1870 Problem Types: CWE-912 Description: Certain models of D-Link wireless routers contain hidden functionality. By sending specific packets to the web service, the attacker can forcibly enable the telnet service and log in using hard-coded credentials. The telnet service enabled through this method can only be accessed from within the same local network as the device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp
network as the device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-8086-93ed5-1.html - https://www.twcert.org.tw/en/cp-139-8087-c3e70-2.html
CVE ID: CVE-2024-45697 State: PUBLISHED Published: 2024-09-16T06:48:58.070Z Last Updated: 2024-09-16T13:14:25.644Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: D-Link Products: DIR-X4860 A1 Problem Types: CWE-912 Description: Certain models of D-Link wireless routers have a hidden functionality where the telnet service is enabled when the WAN port is plugged in. Unauthorized remote attackers can log in and execute OS commands using hard-coded credentials. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-8088-590ed-1.html - https://www.twcert.org.tw/en/cp-139-8089-32df6-2.html
CVE ID: CVE-2024-45698 State: PUBLISHED Published: 2024-09-16T06:52:52.517Z Last Updated: 2025-09-15T19:24:37.872Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: D-Link Products: DIR-X4860 A1 Problem Types: CWE-78 Description: Certain models of D-Link wireless routers do not properly validate user input in the telnet service, allowing unauthenticated remote attackers to use hard-coded credentials to log into telnet and inject arbitrary OS commands, which can then be executed on the device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-8090-bf06b-1.html - https://www.twcert.org.tw/en/cp-139-8091-bcd52-
t: References: - https://www.twcert.org.tw/tw/cp-132-8090-bf06b-1.html - https://www.twcert.org.tw/en/cp-139-8091-bcd52-2.html
CVE ID: CVE-2024-45699 State: PUBLISHED Published: 2025-04-02T06:12:58.345Z Last Updated: 2025-11-03T19:30:55.656Z Vendors: Zabbix Products: Zabbix Problem Types: CWE-79 Description: The endpoint /zabbix.php?action=export.valuemaps suffers from a Cross-Site Scripting vulnerability via the backurl parameter. This is caused by the reflection of user-supplied data without appropriate HTML escaping or output encoding. As a result, a JavaScript payload may be injected into the above endpoint causing it to be executed within the context of the victim's browser. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.zabbix.com/browse/ZBX-26254
CVE ID: CVE-2024-45700 State: PUBLISHED Published: 2025-04-02T06:13:26.681Z Last Updated: 2025-11-03T19:30:57.037Z Vendors: Zabbix Products: Zabbix Problem Types: CWE-770 Description: Zabbix server is vulnerable to a DoS vulnerability due to uncontrolled resource exhaustion. An attacker can send specially crafted requests to the server, which will cause the server to allocate an excessive amount of memory and perform CPU-intensive decompression operations, ultimately leading to a service crash. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.zabbix.com/browse/ZBX-26253
CVE ID: CVE-2024-45709 State: PUBLISHED Published: 2024-12-10T08:20:06.921Z Last Updated: 2024-12-10T19:53:27.023Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: SolarWinds Products: Web Help Desk Problem Types: CWE-22 Description: SolarWinds Web Help Desk was susceptible to a local file read vulnerability. This vulnerability requires the software be installed on Linux and configured to use non-default development/test mode making exposure to the vulnerability very limited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.solarwinds.com/trust-center/security-advisories/CVE-2024-45709 - https://documentation.solarwinds.com/en/succ
ttps://www.solarwinds.com/trust-center/security-advisories/CVE-2024-45709 - https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_12-8-4_release_notes.htm
CVE ID: CVE-2024-45710 State: PUBLISHED Published: 2024-10-16T07:16:37.504Z Last Updated: 2025-03-01T04:55:52.193Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: SolarWinds Products: SolarWinds Platform Problem Types: CWE-427 Description: SolarWinds Platform is susceptible to an Uncontrolled Search Path Element Local Privilege Escalation vulnerability. This requires a low privilege account and local access to the affected node machine. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.solarwinds.com/trust-center/security-advisories/CVE-2024-45710
CVE ID: CVE-2024-45711 State: PUBLISHED Published: 2024-10-16T07:27:22.001Z Last Updated: 2024-10-16T13:22:44.193Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: SolarWinds Products: Serv-U Problem Types: CWE-22 Description: SolarWinds Serv-U is vulnerable to a directory traversal vulnerability where remote code execution is possible depending on privileges given to the authenticated user. This issue requires a user to be authenticated and this is present when software environment variables are abused. Authentication is required for this vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.solarwinds.com/trust-center/secu
nerability Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.solarwinds.com/trust-center/security-advisories/CVE-2024-45711
CVE ID: CVE-2024-45712 State: PUBLISHED Published: 2025-04-15T08:39:23.242Z Last Updated: 2025-04-15T13:58:41.012Z Severity: LOW (CVSS 2.6 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N) Vendors: SolarWinds Products: Serv-U Problem Types: CWE-79 Description: SolarWinds Serv-U is vulnerable to a client-side cross-site scripting (XSS) vulnerability. The vulnerability can only be performed by an authenticated account, on the local machine, from the local browser session. Therefore the risk is very low. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.solarwinds.com/trust-center/security-advisories/CVE-2024-45712 - https://documentation.solarwinds.com/en/success_center/
solarwinds.com/trust-center/security-advisories/CVE-2024-45712 - https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_15-5-1_release_notes.htm
CVE ID: CVE-2024-45713 State: PUBLISHED Published: 2024-10-17T11:02:33.170Z Last Updated: 2024-10-17T13:38:01.107Z Severity: MEDIUM (CVSS 5.1 CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:L) Vendors: SolarWinds Products: Kiwi CatTools Problem Types: CWE-209 Description: SolarWinds Kiwi CatTools is susceptible to a sensitive data disclosure vulnerability when a non-default setting has been enabled for troubleshooting purposes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.solarwinds.com/trust-center/security-advisories/CVE-2024-45713
CVE ID: CVE-2024-45714 State: PUBLISHED Published: 2024-10-16T07:26:04.406Z Last Updated: 2024-10-16T13:23:27.763Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N) Vendors: SolarWinds Products: Serv-U Problem Types: CWE-79 Description: Application is vulnerable to Cross Site Scripting (XSS) an authenticated attacker with users’ permissions can modify a variable with a payload. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.solarwinds.com/trust-center/security-advisories/CVE-2024-45714
CVE ID: CVE-2024-45715 State: PUBLISHED Published: 2024-10-16T07:17:59.891Z Last Updated: 2024-10-16T13:27:15.463Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:L) Vendors: SolarWinds Products: SolarWinds Platform Problem Types: CWE-79 Description: The SolarWinds Platform was susceptible to a Cross-Site Scripting vulnerability when performing an edit function to existing elements. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.solarwinds.com/trust-center/security-advisories/CVE-2024-45715
CVE ID: CVE-2024-45717 State: PUBLISHED Published: 2024-12-04T07:05:57.712Z Last Updated: 2024-12-06T04:55:20.687Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L) Vendors: SolarWinds Products: SolarWinds Platform Problem Types: CWE-79 Description: The SolarWinds Platform was susceptible to a XSS vulnerability that affects the search and node information section of the user interface. This vulnerability requires authentication and requires user interaction. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.solarwinds.com/trust-center/security-advisories/CVE-2024-45717 - https://documentation.solarwinds.com/en/success_center/orionplatform/content
center/security-advisories/CVE-2024-45717 - https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2024-4-1_release_notes.htm
CVE ID: CVE-2024-45718 State: PUBLISHED Published: 2025-02-11T07:19:21.975Z Last Updated: 2025-02-11T15:12:15.783Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: SolarWinds Products: Kiwi Syslog NG Problem Types: CWE-312 Description: Sensitive data could be exposed to non- privileged users in a configuration file. Local access to the computer with a low- privileged account is required to access the configuration file containing the sensitive data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.solarwinds.com/trust-center/security-advisories/CVE-2024-45718 - https://documentation.solarwinds.com/en/success_center/kss/content/rele
rust-center/security-advisories/CVE-2024-45718 - https://documentation.solarwinds.com/en/success_center/kss/content/release_notes/kssng_1-3-1_release_notes.htm
CVE ID: CVE-2024-45719 State: PUBLISHED Published: 2024-11-22T14:36:44.588Z Last Updated: 2024-11-22T20:18:15.264Z Vendors: Apache Software Foundation Products: Apache Answer Problem Types: CWE-326 Description: Inadequate Encryption Strength vulnerability in Apache Answer. This issue affects Apache Answer: through 1.4.0. The ids generated using the UUID v1 version are to some extent not secure enough. It can cause the generated token to be predictable. Users are recommended to upgrade to version 1.4.1, which fixes the issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/sz2d0z39k01nbx3r9pj65t76o1hy9491
CVE ID: CVE-2024-45720 State: PUBLISHED Published: 2024-10-09T12:38:28.971Z Last Updated: 2024-10-09T13:27:02.868Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: Apache Software Foundation Products: Apache Subversion Problem Types: CWE-78 Description: On Windows platforms, a "best fit" character encoding conversion of command line arguments to Subversion's executables (e.g., svn.exe, etc.) may lead to unexpected command line argument interpretation, including argument injection and execution of other programs, if a specially crafted command line argument string is processed. All versions of Subversion up to and including Subversion 1.14.3 are affected on Wind
line argument string is processed. All versions of Subversion up to and including Subversion 1.14.3 are affected on Windows platforms only. Users are recommended to upgrade to version Subversion 1.14.4, which fixes this issue. Subversion is not affected on UNIX-like platforms. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://subversion.apache.org/security/CVE-2024-45720-advisory.txt
CVE ID: CVE-2024-45721 State: PUBLISHED Published: 2024-12-23T00:17:55.581Z Last Updated: 2024-12-24T00:39:52.364Z Severity: HIGH (CVSS 7.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Sharp Corporation Products: home 5G HR02, Wi-Fi STATION SH-52B, Wi-Fi STATION SH-54C Problem Types: CWE-78 Description: home 5G HR02, Wi-Fi STATION SH-52B, and Wi-Fi STATION SH-54C contain an OS command injection vulnerability in the HOST name configuration screen. An arbitrary OS command may be executed with the root privilege by an administrative user. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://k-tai.sharp.co.jp/support/info/info083.html - https://jvn.jp/en/jp/JVN61635
CISA ADP Vulnrichment: References: - https://k-tai.sharp.co.jp/support/info/info083.html - https://jvn.jp/en/jp/JVN61635834/
CVE ID: CVE-2024-45722 State: PUBLISHED Published: 2024-12-06T18:13:43.763Z Last Updated: 2024-12-06T20:40:23.216Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Ruijie Products: Reyee OS Problem Types: CWE-1391 Description: Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x uses weak credential mechanism that could allow an attacker to easily calculate MQTT credentials. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-338-01
CVE ID: CVE-2024-45723 State: PUBLISHED Published: 2024-09-26T17:37:26.917Z Last Updated: 2024-10-17T16:56:55.574Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: goTenna Products: Pro ATAK Plugin Problem Types: CWE-338 Description: The goTenna Pro ATAK Plugin does not use SecureRandom when generating passwords for sharing cryptographic keys. The random function in use makes it easier for attackers to brute force this password if the broadcasted encryption key is captured over RF. This only applies to the optional broadcast of an encryption key, so it is advised to share the key with local QR code for higher security operations. Additional Analyst Notes: - C
key, so it is advised to share the key with local QR code for higher security operations. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-270-05
CVE ID: CVE-2024-45731 State: PUBLISHED Published: 2024-10-14T16:46:01.751Z Last Updated: 2025-02-28T11:03:47.249Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: Splunk Products: Splunk Enterprise Problem Types: CWE-23 Description: In Splunk Enterprise for Windows versions below 9.3.1, 9.2.3, and 9.1.6, a low-privileged user that does not hold the "admin" or "power" Splunk roles could write a file to the Windows system root directory, which has a default location in the Windows System32 folder, when Splunk Enterprise for Windows is installed on a separate drive. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://advisory.splunk.com/advisor
n a separate drive. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://advisory.splunk.com/advisories/SVD-2024-1001 - https://research.splunk.com/application/c97e0704-d9c6-454d-89ba-1510a987bf72/
CVE ID: CVE-2024-45732 State: PUBLISHED Published: 2024-10-14T17:03:35.668Z Last Updated: 2025-02-28T11:03:50.807Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) Vendors: Splunk Products: Splunk Enterprise, Splunk Cloud Platform Problem Types: CWE-862 Description: In Splunk Enterprise versions below 9.3.1, and 9.2.0 versions below 9.2.3, and Splunk Cloud Platform versions below 9.2.2403.103, 9.1.2312.200, 9.1.2312.110 and 9.1.2308.208, a low-privileged user that does not hold the "admin" or "power" Splunk roles could run a search as the "nobody" Splunk user in the SplunkDeploymentServerConfig app. This could let the low-privileged user access potentially restricted da
nk user in the SplunkDeploymentServerConfig app. This could let the low-privileged user access potentially restricted data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://advisory.splunk.com/advisories/SVD-2024-1002 - https://research.splunk.com/application/f765c3fe-c3b6-4afe-a932-11dd4f3a024f/
CVE ID: CVE-2024-45733 State: PUBLISHED Published: 2024-10-14T17:03:36.497Z Last Updated: 2025-02-28T11:03:46.564Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Splunk Products: Splunk Enterprise Problem Types: CWE-502 Description: In Splunk Enterprise for Windows versions below 9.2.3 and 9.1.6, a low-privileged user that does not hold the "admin" or "power" Splunk roles could perform a Remote Code Execution (RCE) due to an insecure session storage configuration. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://advisory.splunk.com/advisories/SVD-2024-1003 - https://research.splunk.com/application/c97e0704-d9c6-454d-89ba-1510a987bf72/
CVE ID: CVE-2024-45734 State: PUBLISHED Published: 2024-10-14T17:03:30.412Z Last Updated: 2025-02-28T11:03:43.384Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Splunk Products: Splunk Enterprise Problem Types: CWE-284 Description: In Splunk Enterprise versions 9.3.0, 9.2.3, and 9.1.6, a low-privileged user that does not hold the "admin" or "power" Splunk roles could view images on the machine that runs Splunk Enterprise by using the PDF export feature in Splunk classic dashboards. The images on the machine could be exposed by exporting the dashboard as a PDF, using the local image path in the img tag in the source extensible markup language (XML) code for
he dashboard as a PDF, using the local image path in the img tag in the source extensible markup language (XML) code for the Splunk classic dashboard. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://advisory.splunk.com/advisories/SVD-2024-1004 - https://research.splunk.com/application/7464e2dc-98a5-4af9-87a1-fa6d5a256fa6/
CVE ID: CVE-2024-45735 State: PUBLISHED Published: 2024-10-14T16:45:54.667Z Last Updated: 2025-02-28T11:03:52.049Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Splunk Products: Splunk Enterprise, Splunk Secure Gateway Problem Types: CWE-284 Description: In Splunk Enterprise versions below 9.2.3 and 9.1.6, and Splunk Secure Gateway versions on Splunk Cloud Platform versions below 3.4.259, 3.6.17, and 3.7.0, a low-privileged user that does not hold the "admin" or "power" Splunk roles can see App Key Value Store (KV Store) deployment configuration and public/private keys in the Splunk Secure Gateway App. Additional Analyst Notes: - CISA ADP Vulnrichment: Ref
uration and public/private keys in the Splunk Secure Gateway App. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://advisory.splunk.com/advisories/SVD-2024-1005 - https://research.splunk.com/application/0a3d6035-7bef-4dfa-b01e-84349edac3b4/
CVE ID: CVE-2024-45736 State: PUBLISHED Published: 2024-10-14T17:03:34.828Z Last Updated: 2025-02-28T11:03:54.861Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Splunk Products: Splunk Enterprise, Splunk Cloud Platform Problem Types: CWE-400 Description: In Splunk Enterprise versions below 9.3.1, 9.2.3, and 9.1.6 and Splunk Cloud Platform versions below 9.2.2403.107, 9.1.2312.204, and 9.1.2312.111, a low-privileged user that does not hold the "admin" or "power" Splunk roles could craft a search query with an improperly formatted "INGEST_EVAL" parameter as part of a [Field Transformation](https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Managef
VAL" parameter as part of a [Field Transformation](https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Managefieldtransforms) which could crash the Splunk daemon (splunkd). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://advisory.splunk.com/advisories/SVD-2024-1006 - https://research.splunk.com/application/08978eca-caff-44c1-84dc-53f17def4e14/
CVE ID: CVE-2024-45737 State: PUBLISHED Published: 2024-10-14T17:03:37.328Z Last Updated: 2025-02-28T11:03:53.256Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: Splunk Products: Splunk Enterprise, Splunk Cloud Platform Problem Types: CWE-352 Description: In Splunk Enterprise versions below 9.3.1, 9.2.3, and 9.1.6 and Splunk Cloud Platform versions below 9.2.2403.108, and 9.1.2312.204, a low-privileged user that does not hold the "admin" or "power" Splunk roles could change the maintenance mode state of App Key Value Store (KVStore) through a Cross-Site Request Forgery (CSRF). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://advisory
h a Cross-Site Request Forgery (CSRF). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://advisory.splunk.com/advisories/SVD-2024-1007 - https://research.splunk.com/application/34bac267-a89b-4bd7-a072-a48eef1f15b8/
CVE ID: CVE-2024-45738 State: PUBLISHED Published: 2024-10-14T17:03:38.142Z Last Updated: 2025-02-28T11:03:47.990Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: Splunk Products: Splunk Enterprise Problem Types: CWE-200 Description: In Splunk Enterprise versions below 9.3.1, 9.2.3, and 9.1.6, the software potentially exposes sensitive HTTP parameters to the `_internal` index. This exposure could happen if you configure the Splunk Enterprise `REST_Calls` log channel at the DEBUG logging level. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://advisory.splunk.com/advisories/SVD-2024-1008 - https://research.splunk.com/application/93dc718
nt: References: - https://advisory.splunk.com/advisories/SVD-2024-1008 - https://research.splunk.com/application/93dc7182-c5da-4085-82ec-401abf33d623/
CVE ID: CVE-2024-45739 State: PUBLISHED Published: 2024-10-14T17:03:38.949Z Last Updated: 2025-02-28T11:03:52.768Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: Splunk Products: Splunk Enterprise Problem Types: CWE-200 Description: In Splunk Enterprise versions below 9.3.1, 9.2.3, and 9.1.6, the software potentially exposes plaintext passwords for local native authentication Splunk users. This exposure could happen when you configure the Splunk Enterprise AdminManager log channel at the DEBUG logging level. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://advisory.splunk.com/advisories/SVD-2024-1009 - https://research.splunk.com/app
A ADP Vulnrichment: References: - https://advisory.splunk.com/advisories/SVD-2024-1009 - https://research.splunk.com/application/93dc7182-c5da-4085-82ec-401abf33d623/
CVE ID: CVE-2024-45740 State: PUBLISHED Published: 2024-10-14T17:03:29.360Z Last Updated: 2025-02-28T11:03:58.462Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Splunk Products: Splunk Enterprise, Splunk Cloud Platform Problem Types: CWE-79 Description: In Splunk Enterprise versions below 9.2.3 and 9.1.6 and Splunk Cloud Platform versions below 9.2.2403, a low-privileged user that does not hold the "admin" or "power" Splunk roles could craft a malicious payload through Scheduled Views that could result in execution of unauthorized JavaScript code in the browser of a user. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://advisory.spl