Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-53992 State: PUBLISHED Published: 2024-12-02T17:03:22.631Z Last Updated: 2024-12-05T16:00:15.371Z Vendors: EDM115 Products: unzip-bot Problem Types: CWE-78 Description: unzip-bot is a Telegram bot to extract various types of archives. Users could exploit unsanitized inputs to inject malicious commands that are executed through subprocess.Popen with shell=True. Attackers can exploit this vulnerability using a crafted archive name, password, or video name. This vulnerability is fixed in 7.0.3a. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/EDM115/unzip-bot/security/advisories/GHSA-34cg-7f8c-fm5h - https://github.com/EDM115/unzip-bot/commit
https://github.com/EDM115/unzip-bot/security/advisories/GHSA-34cg-7f8c-fm5h - https://github.com/EDM115/unzip-bot/commit/5213b693eabb562842cdbf21c1074e91bfa00274
CVE ID: CVE-2024-53994 State: PUBLISHED Published: 2025-02-04T21:12:23.126Z Last Updated: 2025-02-04T21:41:27.327Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: discourse Products: discourse Problem Types: CWE-281 Description: Discourse is an open source platform for community discussion. In affected versions users who disable chat in preferences could still be reachable in some cases. This problem has been patched in the latest version of Discourse. Users are advised to upgrade. Users unable to upgrade should disable the chat plugin within site settings. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/discourse/discours
in site settings. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/discourse/discourse/security/advisories/GHSA-mrpw-gwj7-98r6
CVE ID: CVE-2024-53995 State: PUBLISHED Published: 2025-01-08T20:44:53.785Z Last Updated: 2025-02-12T20:31:17.697Z Vendors: SickChill Products: sickchill Problem Types: CWE-601 Description: SickChill is an automatic video library manager for TV shows. A user-controlled `login` endpoint's `next_` parameter takes arbitrary content. Prior to commit c7128a8946c3701df95c285810eb75b2de18bf82, an authenticated attacker may use this to redirect the user to arbitrary destinations, leading to open redirect. Commit c7128a8946c3701df95c285810eb75b2de18bf82 changes the login page to redirect to `settings.DEFAULT_PAGE` instead of to the `next` parameter. Additional Analyst Notes: - CISA ADP Vulnrichment:
irect to `settings.DEFAULT_PAGE` instead of to the `next` parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://securitylab.github.com/advisories/GHSL-2024-283_GHSL-2024-291_sickchill_sickchill/ - https://github.com/SickChill/sickchill/pull/8811 - https://github.com/SickChill/sickchill/commit/c7128a8946c3701df95c285810eb75b2de18bf82 - https://github.com/SickChill/sickchill/blob/846adafdfab579281353ea08a27bbb813f9a9872/sickchill/views/authentication.py#L33
CVE ID: CVE-2024-53996 State: REJECTED Published: N/A Last Updated: 2025-02-11T21:22:08.503Z Description: No description available.
CVE ID: CVE-2024-53999 State: PUBLISHED Published: 2024-12-03T15:39:32.625Z Last Updated: 2024-12-03T17:00:14.581Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N) Vendors: MobSF Products: Mobile-Security-Framework-MobSF Problem Types: CWE-79 Description: Mobile Security Framework (MobSF) is a pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. The application allows users to upload files with scripts in the filename parameter. As a result, a malicious user can upload a script file to the system. When users in the application use the "Diff or Compare" functionality, they are affected by a Stored Cross-Site S
ystem. When users in the application use the "Diff or Compare" functionality, they are affected by a Stored Cross-Site Scripting vulnerability. This vulnerability is fixed in 4.2.9. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-5jc6-h9w7-jm3p - https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/27d165872847f5ae7417caf09f37edeeba741e1e
CVE ID: CVE-2024-54000 State: PUBLISHED Published: 2024-12-03T15:33:56.232Z Last Updated: 2024-12-03T17:01:38.678Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: MobSF Products: Mobile-Security-Framework-MobSF Problem Types: CWE-918 Description: Mobile Security Framework (MobSF) is a pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. In versions prior to 3.9.7, the requests.get() request in the _check_url method is specified as allow_redirects=True, which allows a server-side request forgery when a request to .well-known/assetlinks.json" returns a 302 redirect. This is a bypass of the fix for CVE
quest forgery when a request to .well-known/assetlinks.json" returns a 302 redirect. This is a bypass of the fix for CVE-2024-29190 and is fixed in 3.9.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-m435-9v6r-v5f6 - https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/f22c584aa7d43527970c9da61eb678953cfc0a8e
CVE ID: CVE-2024-54001 State: PUBLISHED Published: 2024-12-05T15:17:47.891Z Last Updated: 2024-12-05T16:41:45.720Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: kanboard Products: kanboard Problem Types: CWE-80 Description: Kanboard is project management software that focuses on the Kanban methodology. HTML can be injected and stored into the application settings section. The fields application_language, application_date_format,application_timezone and application_time_format allow arbirary user input which is reflected. The vulnerability can become xss if the user input is javascript code that bypass CSP. This vulnerability is fixed in 1.2.41. Additional
can become xss if the user input is javascript code that bypass CSP. This vulnerability is fixed in 1.2.41. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/kanboard/kanboard/security/advisories/GHSA-4vvp-jf72-chrj
CVE ID: CVE-2024-54002 State: PUBLISHED Published: 2024-12-04T15:33:04.796Z Last Updated: 2024-12-04T21:39:50.554Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: DependencyTrack Products: dependency-track Problem Types: CWE-203 Description: Dependency-Track is a Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Performing a login request against the /api/v1/user/login endpoint with a username that exist in the system takes significantly longer than performing the same action with a username that is not known by the system. The observable difference in request duration can be leveraged by actors t
h a username that is not known by the system. The observable difference in request duration can be leveraged by actors to enumerate valid names of managed users. LDAP and OpenID Connect users are not affected. The issue has been fixed in Dependency-Track 4.12.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/DependencyTrack/dependency-track/security/advisories/GHSA-9w3m-hm36-w32w
CVE ID: CVE-2024-54003 State: PUBLISHED Published: 2024-11-27T17:03:51.069Z Last Updated: 2024-11-27T19:12:14.356Z Vendors: Jenkins Project Products: Jenkins Simple Queue Plugin Description: Jenkins Simple Queue Plugin 1.4.4 and earlier does not escape the view name, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with View/Create permission. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2024-11-27/#SECURITY-3467
CVE ID: CVE-2024-54004 State: PUBLISHED Published: 2024-11-27T17:03:51.723Z Last Updated: 2024-11-27T18:57:49.010Z Vendors: Jenkins Project Products: Jenkins Filesystem List Parameter Plugin Description: Jenkins Filesystem List Parameter Plugin 0.0.14 and earlier does not restrict the path used for the File system objects list Parameter, allowing attackers with Item/Configure permission to enumerate file names on the Jenkins controller file system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2024-11-27/#SECURITY-3367
CVE ID: CVE-2024-54005 State: PUBLISHED Published: 2024-12-10T13:54:15.994Z Last Updated: 2024-12-10T17:17:46.788Z Severity: MEDIUM (CVSS 5.1 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Siemens Products: COMOS V10.3, COMOS V10.4.0, COMOS V10.4.1, COMOS V10.4.2, COMOS V10.4.3, COMOS V10.4.4, COMOS V10.4.4.1 Problem Types: CWE-611 Description: A vulnerability has been identified in COMOS V10.3 (All versions < V10.3.3.5.8), COMOS V10.4.0 (All versions), COMOS V10.4.1 (All versions), COMOS V10.4.2 (All versions), COMOS V10.4.3 (All versions < V10.4.3.0.47), COMOS V10.4.4 (All versions < V10.4.4.2), COMOS V10.4.4.1 (All versions < V10.4.4.1.21). The PDMS/E3D Engineering Interface impro
.4.4 (All versions < V10.4.4.2), COMOS V10.4.4.1 (All versions < V10.4.4.1.21). The PDMS/E3D Engineering Interface improperly handles XML External Entity (XXE) entries when communicating with an external application. This could allow an attacker to extract any file with a known location on the user's system or accessible network folders by injecting malicious data into the communication channel between the two systems. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-701627.html
CVE ID: CVE-2024-54006 State: PUBLISHED Published: 2025-01-07T17:12:19.205Z Last Updated: 2025-01-07T18:11:25.564Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Hewlett Packard Enterprise (HPE) Products: HPE Aruba Networking 501 Wireless Client Bridge Description: Multiple command injection vulnerabilities exist in the web interface of the 501 Wireless Client Bridge which could lead to authenticated remote command execution. Successful exploitation of these vulnerabilities result in the ability of an attacker to execute arbitrary commands as a privileged user on the underlying operating system. Exploitation requires administrative authentication credentials
s a privileged user on the underlying operating system. Exploitation requires administrative authentication credentials on the host system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04763en_us&docLocale=en_US
CVE ID: CVE-2024-54007 State: PUBLISHED Published: 2025-01-07T17:17:39.607Z Last Updated: 2025-01-07T18:36:07.946Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Hewlett Packard Enterprise (HPE) Products: HPE Aruba Networking 501 Wireless Client Bridge Description: Multiple command injection vulnerabilities exist in the web interface of the 501 Wireless Client Bridge which could lead to authenticated remote command execution. Successful exploitation of these vulnerabilities result in the ability of an attacker to execute arbitrary commands as a privileged user on the underlying operating system. Exploitation requires administrative authentication credentials
CVE ID: CVE-2024-54008 State: PUBLISHED Published: 2024-12-10T18:23:19.858Z Last Updated: 2024-12-11T14:04:56.167Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Hewlett Packard Enterprise (HPE) Products: HPE Aruba Networking AirWave Management Platform Description: An authenticated Remote Code Execution (RCE) vulnerability exists in the AirWave CLI. Successful exploitation of this vulnerability could allow a remote authenticated threat actor to run arbitrary commands as a privileged user on the underlying host. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04765en_us&docLocale=en
ISA ADP Vulnrichment: References: - https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04765en_us&docLocale=en_US
CVE ID: CVE-2024-54009 State: PUBLISHED Published: 2024-12-19T22:19:21.013Z Last Updated: 2024-12-20T17:10:39.852Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N) Vendors: Hewlett Packard Enterprise (HPE) Products: HPE Alletra Storage MP B10000 Problem Types: CWE-200 Description: Remote authentication bypass vulnerability in HPE Alletra Storage MP B10000 in versions prior to version 10.4.5 could be remotely exploited to allow disclosure of information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbst04764en_us&docLocale=en_US
CVE ID: CVE-2024-54010 State: PUBLISHED Published: 2025-01-08T20:42:21.216Z Last Updated: 2025-01-31T17:57:52.529Z Severity: LOW (CVSS 3.4 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N) Vendors: Hewlett Packard Enterprise (HPE) Products: AOS-CX Description: A vulnerability in the firewall component of HPE Aruba Networking CX 10000 Series Switches exists. It could allow an unauthenticated adjacent attacker to conduct a packet forwarding attack against the ICMP and UDP protocol. For this attack to be successful an attacker requires a switch configuration that allows packets routing (at layer 3). Configurations that do not allow network traffic routing are not impacted. Successful exploitation c
uting (at layer 3). Configurations that do not allow network traffic routing are not impacted. Successful exploitation could allow an attacker to bypass security policies, potentially leading to unauthorized data exposure. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://csaf.arubanetworks.com/2024/hpe_aruba_networking_-_hpesbnw04772.txt
CVE ID: CVE-2024-54014 State: PUBLISHED Published: 2024-12-05T02:42:14.019Z Last Updated: 2024-12-05T11:33:27.693Z Severity: LOW (CVSS 3.6 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N) Vendors: SKYLARK HOLDINGS CO., LTD. Products: 'Skylark' App for Android, 'Skylark' App for iOS Problem Types: CWE-939 Description: Improper authorization in handler for custom URL scheme issue in 'Skylark' App for Android 6.2.13 and earlier and 'Skylark' App for iOS 6.2.13 and earlier allows an attacker to lead the application to access an arbitrary web site via another application installed on the user's device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://play.google.com/store/app
on the user's device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://play.google.com/store/apps/details?id=jp.co.skylark.app.gusto - https://apps.apple.com/jp/app/%E3%81%99%E3%81%8B%E3%81%84%E3%82%89%E3%83%BC%E3%81%8F%E3%82%A2%E3%83%97%E3%83%AA/id906930478 - https://jvn.jp/en/jp/JVN03447226/
CVE ID: CVE-2024-54015 State: PUBLISHED Published: 2025-02-11T10:28:58.684Z Last Updated: 2025-08-12T11:16:51.928Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Siemens Products: SIPROTEC 5 6MD84 (CP300), SIPROTEC 5 6MD85 (CP300), SIPROTEC 5 6MD86 (CP300), SIPROTEC 5 6MD89 (CP300), SIPROTEC 5 6MD89 (CP300) V9.6x, SIPROTEC 5 6MU85 (CP300), SIPROTEC 5 7KE85 (CP300), SIPROTEC 5 7SA82 (CP150), SIPROTEC 5 7SA86 (CP300), SIPROTEC 5 7SA87 (CP300), SIPROTEC 5 7SD82 (CP150), SIPROTEC 5 7SD86 (CP300), SIPROTEC 5 7SD87 (CP300), SIPROTEC 5 7SJ81 (CP150), SIPROTEC 5 7SJ82 (CP150), SIPROTEC 5 7SJ85 (CP300), SIPROTEC 5 7SJ86 (CP300), SIPROTEC 5 7SK82 (CP150), SIPROTEC 5 7S
), SIPROTEC 5 7SJ82 (CP150), SIPROTEC 5 7SJ85 (CP300), SIPROTEC 5 7SJ86 (CP300), SIPROTEC 5 7SK82 (CP150), SIPROTEC 5 7SK85 (CP300), SIPROTEC 5 7SL82 (CP150), SIPROTEC 5 7SL86 (CP300), SIPROTEC 5 7SL87 (CP300), SIPROTEC 5 7SS85 (CP300), SIPROTEC 5 7ST85 (CP300), SIPROTEC 5 7ST85 (CP300) V9.6x, SIPROTEC 5 7ST86 (CP300), SIPROTEC 5 7ST86 (CP300) V9.8x, SIPROTEC 5 7SX82 (CP150), SIPROTEC 5 7SX85 (CP300), SIPROTEC 5 7SY82 (CP150), SIPROTEC 5 7UM85 (CP300), SIPROTEC 5 7UT82 (CP150), SIPROTEC 5 7UT85 (CP300), SIPROTEC 5 7UT86 (CP300), SIPROTEC 5 7UT87 (CP300), SIPROTEC 5 7VE85 (CP300), SIPROTEC 5 7VK87 (CP300), SIPROTEC 5 7VU85 (CP300), SIPROTEC 5 Communication Module ETH-BA-2EL (Rev.2), SIPROTEC
P300), SIPROTEC 5 7VK87 (CP300), SIPROTEC 5 7VU85 (CP300), SIPROTEC 5 Communication Module ETH-BA-2EL (Rev.2), SIPROTEC 5 Communication Module ETH-BA-2EL (Rev.2) V9.6, SIPROTEC 5 Communication Module ETH-BA-2EL (Rev.2) V9.8, SIPROTEC 5 Communication Module ETH-BB-2FO (Rev. 2), SIPROTEC 5 Communication Module ETH-BB-2FO (Rev. 2) V9.6, SIPROTEC 5 Communication Module ETH-BB-2FO (Rev. 2) V9.8, SIPROTEC 5 Communication Module ETH-BD-2FO, SIPROTEC 5 Communication Module ETH-BD-2FO V9.6, SIPROTEC 5 Communication Module ETH-BD-2FO V9.8, SIPROTEC 5 Compact 7SX800 (CP050) Problem Types: CWE-1392 Description: A vulnerability has been identified in SIPROTEC 5 6MD84 (CP300) (All versions < V9.90), SIPRO
pes: CWE-1392 Description: A vulnerability has been identified in SIPROTEC 5 6MD84 (CP300) (All versions < V9.90), SIPROTEC 5 6MD85 (CP300) (All versions >= V8.80 < V9.90), SIPROTEC 5 6MD86 (CP300) (All versions >= V8.80 < V9.90), SIPROTEC 5 6MD89 (CP300) (All versions >= V8.80 < V9.90), SIPROTEC 5 6MD89 (CP300) V9.6x (All versions < V9.68), SIPROTEC 5 6MU85 (CP300) (All versions >= V8.80 < V9.90), SIPROTEC 5 7KE85 (CP300) (All versions >= V8.80 < V10.0), SIPROTEC 5 7SA82 (CP150) (All versions < V9.90), SIPROTEC 5 7SA86 (CP300) (All versions >= V8.80 < V9.90), SIPROTEC 5 7SA87 (CP300) (All versions >= V8.80 < V9.90), SIPROTEC 5 7SD82 (CP150) (All versions < V9.90), SIPROTEC 5 7SD86 (CP300) (
A87 (CP300) (All versions >= V8.80 < V9.90), SIPROTEC 5 7SD82 (CP150) (All versions < V9.90), SIPROTEC 5 7SD86 (CP300) (All versions >= V8.80 < V9.90), SIPROTEC 5 7SD87 (CP300) (All versions >= V8.80 < V9.90), SIPROTEC 5 7SJ81 (CP150) (All versions < V9.90), SIPROTEC 5 7SJ82 (CP150) (All versions < V9.90), SIPROTEC 5 7SJ85 (CP300) (All versions >= V8.80 < V9.90), SIPROTEC 5 7SJ86 (CP300) (All versions >= V8.80 < V9.90), SIPROTEC 5 7SK82 (CP150) (All versions < V9.90), SIPROTEC 5 7SK85 (CP300) (All versions >= V8.80 < V9.90), SIPROTEC 5 7SL82 (CP150) (All versions < V9.90), SIPROTEC 5 7SL86 (CP300) (All versions >= V8.80 < V9.90), SIPROTEC 5 7SL87 (CP300) (All versions >= V8.80 < V9.90), SIPR
SIPROTEC 5 7SL86 (CP300) (All versions >= V8.80 < V9.90), SIPROTEC 5 7SL87 (CP300) (All versions >= V8.80 < V9.90), SIPROTEC 5 7SS85 (CP300) (All versions >= V8.80 < V9.90), SIPROTEC 5 7ST85 (CP300) (All versions >= V8.80 < V10.0), SIPROTEC 5 7ST85 (CP300) V9.6x (All versions < V9.68), SIPROTEC 5 7ST86 (CP300) (All versions < V10.0), SIPROTEC 5 7ST86 (CP300) V9.8x (All versions < V9.83), SIPROTEC 5 7SX82 (CP150) (All versions < V9.90), SIPROTEC 5 7SX85 (CP300) (All versions >= V8.80 < V9.90), SIPROTEC 5 7SY82 (CP150) (All versions < V9.90), SIPROTEC 5 7UM85 (CP300) (All versions >= V8.80 < V9.90), SIPROTEC 5 7UT82 (CP150) (All versions < V9.90), SIPROTEC 5 7UT85 (CP300) (All versions >= V8.8
sions >= V8.80 < V9.90), SIPROTEC 5 7UT82 (CP150) (All versions < V9.90), SIPROTEC 5 7UT85 (CP300) (All versions >= V8.80 < V9.90), SIPROTEC 5 7UT86 (CP300) (All versions >= V8.80 < V9.90), SIPROTEC 5 7UT87 (CP300) (All versions >= V8.80 < V9.90), SIPROTEC 5 7VE85 (CP300) (All versions >= V8.80 < V9.90), SIPROTEC 5 7VK87 (CP300) (All versions >= V8.80 < V9.90), SIPROTEC 5 7VU85 (CP300) (All versions < V9.90), SIPROTEC 5 Communication Module ETH-BA-2EL (Rev.2) (All versions < V9.90), SIPROTEC 5 Communication Module ETH-BA-2EL (Rev.2) V9.6 (All versions < V9.68), SIPROTEC 5 Communication Module ETH-BA-2EL (Rev.2) V9.8 (All versions < V9.83), SIPROTEC 5 Communication Module ETH-BB-2FO (Rev. 2)
ommunication Module ETH-BA-2EL (Rev.2) V9.8 (All versions < V9.83), SIPROTEC 5 Communication Module ETH-BB-2FO (Rev. 2) (All versions < V9.90), SIPROTEC 5 Communication Module ETH-BB-2FO (Rev. 2) V9.6 (All versions < V9.68), SIPROTEC 5 Communication Module ETH-BB-2FO (Rev. 2) V9.8 (All versions < V9.83), SIPROTEC 5 Communication Module ETH-BD-2FO (All versions >= V8.80 < V9.90), SIPROTEC 5 Communication Module ETH-BD-2FO V9.6 (All versions < V9.68), SIPROTEC 5 Communication Module ETH-BD-2FO V9.8 (All versions < V9.83), SIPROTEC 5 Compact 7SX800 (CP050) (All versions >= V9.50 < V9.90). Affected devices do not properly validate SNMP GET requests. This could allow an unauthenticated, remote at
50 < V9.90). Affected devices do not properly validate SNMP GET requests. This could allow an unauthenticated, remote attacker to retrieve sensitive information of the affected devices with SNMPv2 GET requests using default credentials. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-767615.html
CVE ID: CVE-2024-54016 State: PUBLISHED Published: 2025-03-20T08:59:26.175Z Last Updated: 2025-03-20T19:04:01.239Z Vendors: Apache Software Foundation Products: Apache Seata (incubating) Problem Types: CWE-409 Description: Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Seata (incubating). This issue affects Apache Seata (incubating): through <=2.2.0. Users are recommended to upgrade to version 2.3.0, which fixes the issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/grn0x8tmssx07qc9z50lwgmrkwzrrhzg
CVE ID: CVE-2024-54018 State: PUBLISHED Published: 2025-03-11T14:54:37.970Z Last Updated: 2025-03-12T04:00:46.742Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:C) Vendors: Fortinet Products: FortiSandbox Problem Types: CWE-78 Description: Multiple improper neutralization of special elements used in an OS Command vulnerabilities [CWE-78] in FortiSandbox before 4.4.5 allows a privileged attacker to execute unauthorized commands via crafted requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-24-110
CVE ID: CVE-2024-54019 State: PUBLISHED Published: 2025-06-10T16:36:06.088Z Last Updated: 2025-06-10T19:40:16.375Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N/E:P/RL:W/RC:C) Vendors: Fortinet Products: FortiClientWindows Problem Types: CWE-297 Description: A improper validation of certificate with host mismatch in Fortinet FortiClientWindows version 7.4.0, versions 7.2.0 through 7.2.6, and 7.0 all versions allow an unauthorized attacker to redirect VPN connections via DNS spoofing or another form of redirection. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-24-365
CVE ID: CVE-2024-54020 State: PUBLISHED Published: 2025-05-28T07:55:32.497Z Last Updated: 2025-05-28T14:21:37.049Z Severity: LOW (CVSS 2.1 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C) Vendors: Fortinet Products: FortiManager Problem Types: CWE-862 Description: A missing authorization in Fortinet FortiManager versions 7.2.0 through 7.2.1, and versions 7.0.0 through 7.0.7 may allow an authenticated attacker to overwrite global threat feeds via crafted update requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-24-023
CVE ID: CVE-2024-54021 State: PUBLISHED Published: 2025-01-14T14:09:48.859Z Last Updated: 2025-08-06T18:04:37.181Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:F/RL:X/RC:C) Vendors: Fortinet Products: FortiOS, FortiProxy Problem Types: CWE-113 Description: An Improper Neutralization of CRLF Sequences in HTTP Headers ('http response splitting') vulnerability [CWE-113] in Fortinet FortiOS 7.2.0 through 7.6.0, FortiProxy 7.2.0 through 7.4.5 may allow a remote unauthenticated attacker to bypass the file filter via crafted HTTP headers. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-24-282