Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-7567 State: PUBLISHED Published: 2024-08-13T17:51:45.882Z Last Updated: 2024-08-13T18:37:13.727Z Vendors: Rockwell Automation Products: PLC - Micro850/870 (2080 -L50E/2080 -L70E) Problem Types: CWE-400 Description: A denial-of-service vulnerability exists via the CIP/Modbus port in the Rockwell Automation Micro850/870 (2080 -L50E/2080 -L70E). If exploited, the CIP/Modbus communication may be disrupted for short duration. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1684.html
CVE ID: CVE-2024-7568 State: PUBLISHED Published: 2024-08-24T02:02:31.547Z Last Updated: 2024-08-26T15:13:13.151Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: brandondove Products: Favicon Generator (CLOSED) Problem Types: CWE-352 Description: The Favicon Generator plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5. This is due to missing or incorrect nonce validation on the output_sub_admin_page_0 function. This makes it possible for unauthenticated attackers to delete arbitrary files on the server via a forged request granted they can trick a site administrator into performing an action such as click
s on the server via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. The plugin author deleted the functionality of the plugin to patch this issue and close the plugin, we recommend seeking an alternative to this plugin. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6eb3ad80-3510-4018-91af-b733ef62e28f?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3139340%40favicon-generator&new=3139340%40favicon-generator&sfp_email=&sfph_mail=
CVE ID: CVE-2024-7569 State: PUBLISHED Published: 2024-08-13T18:10:55.710Z Last Updated: 2024-08-16T04:02:04.140Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: Ivanti Products: ITSM Problem Types: CWE-922, CWE-215 Description: An information disclosure vulnerability in Ivanti ITSM on-prem and Neurons for ITSM versions 2023.4 and earlier allows an unauthenticated attacker to obtain the OIDC client secret via debug information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Neurons-for-ITSM-CVE-2024-7569-CVE-2024-7570
CVE ID: CVE-2024-7570 State: PUBLISHED Published: 2024-08-13T18:12:45.157Z Last Updated: 2024-08-16T04:02:05.349Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: Ivanti Products: ITSM Problem Types: CWE-295 Description: Improper certificate validation in Ivanti ITSM on-prem and Neurons for ITSM Versions 2023.4 and earlier allows a remote attacker in a MITM position to craft a token that would allow access to ITSM as any user. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Neurons-for-ITSM-CVE-2024-7569-CVE-2024-7570
CVE ID: CVE-2024-7571 State: PUBLISHED Published: 2024-11-12T16:14:02.778Z Last Updated: 2024-11-19T17:15:02.280Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Ivanti Products: Secure Access Client Problem Types: CWE-267 Description: Incorrect permissions in Ivanti Secure Access Client before 22.7R4 allows a local authenticated attacker to escalate their privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-ICS-Ivanti-Policy-Secure-IPS-Ivanti-Secure-Access-Client-ISAC-Multiple-CVEs
CVE ID: CVE-2024-7572 State: PUBLISHED Published: 2024-12-10T18:53:39.709Z Last Updated: 2024-12-10T20:13:13.330Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) Vendors: Ivanti Products: Desktop and Server Management Problem Types: CWE-732 Description: Insufficient permissions in Ivanti DSM before version 2024.3.5740 allows a local authenticated attacker to delete arbitrary files. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Desktop-and-Server-Management-DSM-CVE-2024-7572
CVE ID: CVE-2024-7573 State: PUBLISHED Published: 2024-08-28T02:05:44.057Z Last Updated: 2024-08-28T13:48:45.580Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: msaari Products: Relevanssi Live Ajax Search Problem Types: CWE-88 Description: The Relevanssi Live Ajax Search plugin for WordPress is vulnerable to argument injection in all versions up to, and including, 2.4. This is due to insufficient validation of input supplied via POST data in the 'search' function. This makes it possible for unauthenticated attackers to inject arbitrary arguments into a WP_Query query and potentially expose sensitive information such as attachments or private posts. Additio
guments into a WP_Query query and potentially expose sensitive information such as attachments or private posts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/bbcb648a-4a3e-4645-bd62-4415b1cf6516?source=cve - https://plugins.trac.wordpress.org/changeset/3135074/relevanssi-live-ajax-search
CVE ID: CVE-2024-7574 State: PUBLISHED Published: 2024-08-10T05:37:25.794Z Last Updated: 2024-08-13T15:28:18.471Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: cyberfoxdigital Products: Christmasify! Problem Types: CWE-352 Description: The Christmasify! plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5.5. This is due to missing nonce validation on the 'options' function. This makes it possible for unauthenticated attackers to modify the plugin's settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ac247d3a-9e60-431e-ac98-2601e9907758?source=cve - https://plugins.trac.wordpress.org/changeset/3132621/christmasify
CVE ID: CVE-2024-7575 State: PUBLISHED Published: 2024-09-25T13:55:59.435Z Last Updated: 2024-09-25T14:19:30.019Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Progress Software Products: Telerik UI for WPF Problem Types: CWE-77 Description: In Progress Telerik UI for WPF versions prior to 2024 Q3 (2024.3.924), a command injection attack is possible through improper neutralization of hyperlink elements. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.telerik.com/devtools/wpf/knowledge-base/command-injection-cve-2024-7575
CVE ID: CVE-2024-7576 State: PUBLISHED Published: 2024-09-25T13:57:35.699Z Last Updated: 2024-09-25T14:17:24.219Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Progress Software Products: Telerik UI for WPF Problem Types: CWE-502 Description: In Progress Telerik UI for WPF versions prior to 2024 Q3 (2024.3.924), a code execution attack is possible through an insecure deserialization vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.telerik.com/devtools/wpf/knowledge-base/unsafe-deserialization-cve-2024-7576
CVE ID: CVE-2024-7577 State: PUBLISHED Published: 2025-03-28T23:50:36.870Z Last Updated: 2025-09-01T00:59:50.563Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: InfoSphere Information Server Problem Types: CWE-532 Description: IBM InfoSphere Information Server 11.7 could disclose sensitive user credentials from log files during new installation of the product. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7185020
CVE ID: CVE-2024-7578 State: PUBLISHED Published: 2024-08-07T13:00:07.939Z Last Updated: 2024-08-07T17:19:31.123Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Alien Technology Products: ALR-F800 Problem Types: CWE-285 Description: A vulnerability was found in Alien Technology ALR-F800 up to 19.10.24.00. It has been classified as critical. Affected is an unknown function of the file /var/www/cmd.php. The manipulation of the argument cmd leads to improper authorization. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional A
and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.273858 - https://vuldb.com/?ctiid.273858 - https://vuldb.com/?submit.382469 - https://github.com/Push3AX/vul/blob/main/Alien%20Technology%20/ALR-F800.md
CVE ID: CVE-2024-7579 State: PUBLISHED Published: 2024-08-07T14:00:08.086Z Last Updated: 2024-08-07T15:24:06.724Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Alien Technology Products: ALR-F800 Problem Types: CWE-78 Description: A vulnerability was found in Alien Technology ALR-F800 up to 19.10.24.00. It has been declared as critical. Affected by this vulnerability is the function popen of the file /var/www/cgi-bin/upgrade.cgi of the component File Name Handler. The manipulation of the argument uploadedFile leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early abo
aunched remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.273859 - https://vuldb.com/?ctiid.273859 - https://vuldb.com/?submit.382470 - https://github.com/Push3AX/vul/blob/main/Alien%20Technology%20/ALR-F800.md
CVE ID: CVE-2024-7580 State: PUBLISHED Published: 2024-08-07T14:31:04.007Z Last Updated: 2024-08-22T15:40:34.979Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Alien Technology Products: ALR-F800 Problem Types: CWE-78 Description: A vulnerability was found in Alien Technology ALR-F800 up to 19.10.24.00. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/system.html. The manipulation of the argument uploadedFile with the input ;whoami leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but di
loit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.273860 - https://vuldb.com/?ctiid.273860 - https://vuldb.com/?submit.382481 - https://github.com/Push3AX/vul/blob/main/Alien%20Technology%20/ALR-F800.md
CVE ID: CVE-2024-7581 State: PUBLISHED Published: 2024-08-07T15:00:09.496Z Last Updated: 2024-08-07T15:40:44.206Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: Tenda Products: A301 Problem Types: CWE-121 Description: A vulnerability classified as critical has been found in Tenda A301 15.13.08.12. This affects the function formWifiBasicSet of the file /goform/WifiBasicSet. The manipulation of the argument security leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CIS
TE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.273861 - https://vuldb.com/?ctiid.273861 - https://vuldb.com/?submit.382745 - https://github.com/BeaCox/IoT_vuln/tree/main/tenda/A301/WifiBasicSet_bof
CVE ID: CVE-2024-7582 State: PUBLISHED Published: 2024-08-07T15:31:04.959Z Last Updated: 2024-08-07T17:41:35.463Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: Tenda Products: i22 Problem Types: CWE-120 Description: A vulnerability classified as critical was found in Tenda i22 1.0.0.3(4687). This vulnerability affects the function formApPortalAccessCodeAuth of the file /goform/apPortalAccessCodeAuth. The manipulation of the argument accessCode/data/acceInfo leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Addition
lic and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.273862 - https://vuldb.com/?ctiid.273862 - https://vuldb.com/?submit.382834 - https://github.com/BeaCox/IoT_vuln/tree/main/tenda/i22/ApPortalAccessCodeAuth
CVE ID: CVE-2024-7583 State: PUBLISHED Published: 2024-08-07T16:00:08.539Z Last Updated: 2024-08-07T17:37:33.704Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: Tenda Products: i22 Problem Types: CWE-120 Description: A vulnerability, which was classified as critical, has been found in Tenda i22 1.0.0.3(4687). This issue affects the function formApPortalOneKeyAuth of the file /goform/apPortalOneKeyAuth. The manipulation of the argument data leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: -
. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.273863 - https://vuldb.com/?ctiid.273863 - https://vuldb.com/?submit.382835 - https://github.com/BeaCox/IoT_vuln/tree/main/tenda/i22/ApPortalOneKeyAuth
CVE ID: CVE-2024-7584 State: PUBLISHED Published: 2024-08-07T16:31:04.683Z Last Updated: 2024-08-07T17:47:32.819Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: Tenda Products: i22 Problem Types: CWE-120 Description: A vulnerability, which was classified as critical, was found in Tenda i22 1.0.0.3(4687). Affected is the function formApPortalPhoneAuth of the file /goform/apPortalPhoneAuth. The manipulation of the argument data leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA
: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.273864 - https://vuldb.com/?ctiid.273864 - https://vuldb.com/?submit.382836 - https://github.com/BeaCox/IoT_vuln/tree/main/tenda/i22/ApPortalPhoneAuth
CVE ID: CVE-2024-7585 State: PUBLISHED Published: 2024-08-07T17:00:06.990Z Last Updated: 2024-08-07T18:12:56.690Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: Tenda Products: i22 Problem Types: CWE-120 Description: A vulnerability has been found in Tenda i22 1.0.0.3(4687) and classified as critical. Affected by this vulnerability is the function formApPortalWebAuth of the file /goform/apPortalAuth. The manipulation of the argument webUserName/webUserPassword leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additio
blic and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.273865 - https://vuldb.com/?ctiid.273865 - https://vuldb.com/?submit.382837 - https://github.com/BeaCox/IoT_vuln/tree/main/tenda/i22/ApPortalWebAuth
CVE ID: CVE-2024-7586 State: PUBLISHED Published: 2025-06-20T13:58:37.159Z Last Updated: 2025-06-20T14:53:39.330Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-532 Description: An issue was discovered in GitLab EE affecting all versions starting from 17.0 prior to 17.0.6, starting from 17.1 prior to 17.1.4, and starting from 17.2 prior to 17.2.2, where webhook deletion audit log preserved auth credentials. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/463866
CVE ID: CVE-2024-7587 State: PUBLISHED Published: 2024-10-22T22:19:20.646Z Last Updated: 2024-11-06T15:50:04.628Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Mitsubishi Electric Corporation, ICONICS Products: GENESIS64, MC Works64 Problem Types: CWE-276 Description: Incorrect Default Permissions vulnerability in GenBroker32, which is included in the installers for ICONICS GENESIS64 version 10.97.3 and prior, Mitsubishi Electric GENESIS64 version 10.97.3 and prior and Mitsubishi Electric MC Works64 all versions allows a local authenticated attacker to disclose or tamper with confidential information and data contained in the products, or cause a denial of s
attacker to disclose or tamper with confidential information and data contained in the products, or cause a denial of service (DoS) condition on the products, by accessing a folder with incorrect permissions, when GenBroker32 is installed on the same PC as GENESIS64 or MC Works64. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2024-008_en.pdf - https://jvn.jp/vu/JVNVU95548104 - https://www.cisa.gov/news-events/ics-advisories/icsa-24-296-01
CVE ID: CVE-2024-7588 State: PUBLISHED Published: 2024-08-14T04:29:54.973Z Last Updated: 2024-08-15T15:22:23.399Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: pickplugins Products: Gutenberg Blocks, Page Builder – ComboBlocks Problem Types: CWE-79 Description: The Gutenberg Blocks, Page Builder – ComboBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Accordion block in all versions up to, and including, 2.2.87 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scri
his makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/248a9cb2-24e8-46b2-9ef8-23a8444a922d?source=cve - https://plugins.trac.wordpress.org/changeset/3133880/post-grid
CVE ID: CVE-2024-7589 State: PUBLISHED Published: 2024-08-11T03:15:52.181Z Last Updated: 2024-08-16T17:02:48.552Z Vendors: FreeBSD Products: FreeBSD Description: A signal handler in sshd(8) may call a logging function that is not async-signal-safe. The signal handler is invoked when a client does not authenticate within the LoginGraceTime seconds (120 by default). This signal handler executes in the context of the sshd(8)'s privileged code, which is not sandboxed and runs with full root privileges. This issue is another instance of the problem in CVE-2024-6387 addressed by FreeBSD-SA-24:04.openssh. The faulty code in this case is from the integration of blacklistd in OpenSSH in FreeBSD. As a
FreeBSD-SA-24:04.openssh. The faulty code in this case is from the integration of blacklistd in OpenSSH in FreeBSD. As a result of calling functions that are not async-signal-safe in the privileged sshd(8) context, a race condition exists that a determined attacker may be able to exploit to allow an unauthenticated remote code execution as root. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://security.freebsd.org/advisories/FreeBSD-SA-24:08.openssh.asc - https://www.cve.org/CVERecord?id=CVE-2006-5051 - https://www.cve.org/CVERecord?id=CVE-2024-6387
CVE ID: CVE-2024-7590 State: PUBLISHED Published: 2024-08-12T21:47:59.631Z Last Updated: 2024-08-13T19:18:34.695Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Brainstorm Force Products: Spectra Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Brainstorm Force Spectra allows Stored XSS.This issue affects Spectra: from n/a through 2.14.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/ultimate-addons-for-gutenberg/wordpress-spectra-wordpress-gutenberg-blocks-plugin-2-14-1-cross-site-scripting-xss-vuln
y/ultimate-addons-for-gutenberg/wordpress-spectra-wordpress-gutenberg-blocks-plugin-2-14-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-7591 State: PUBLISHED Published: 2024-09-05T17:16:30.342Z Last Updated: 2025-02-18T15:36:20.769Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Progress Products: LoadMaster Problem Types: CWE-78 Description: Improper Input Validation vulnerability in Progress LoadMaster allows OS Command Injection.This issue affects: * LoadMaster: 7.2.40.0 and above * ECS: All versions * Multi-Tenancy: 7.1.35.4 and above Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.kemptechnologies.com/hc/en-us/articles/29196371689613-LoadMaster-Security-Vulnerability-CVE-2024-7591 - https://insinuator.net/2024/11/vulnerability-disclosu
s/29196371689613-LoadMaster-Security-Vulnerability-CVE-2024-7591 - https://insinuator.net/2024/11/vulnerability-disclosure-command-injection-in-kemp-loadmaster-load-balancer-cve-2024-7591
CVE ID: CVE-2024-7592 State: PUBLISHED Published: 2024-08-19T19:06:45.311Z Last Updated: 2025-11-03T22:32:52.863Z Vendors: Python Software Foundation Products: CPython Problem Types: CWE-400 Description: There is a LOW severity vulnerability affecting CPython, specifically the 'http.cookies' standard library module. When parsing cookies that contained backslashes for quoted characters in the cookie value, the parser would use an algorithm with quadratic complexity, resulting in excess CPU resources being used while parsing the value. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/python/cpython/pull/123075 - https://github.com/pyt
nrichment: - CVE Program Container: References: - https://github.com/python/cpython/pull/123075 - https://github.com/python/cpython/issues/123067 - https://mail.python.org/archives/list/security-announce@python.org/thread/HXJAAAALNUNGCQUS2W7WR6GFIZIHFOOK/ - https://github.com/python/cpython/commit/391e5626e3ee5af267b97e37abc7475732e67621 - https://github.com/python/cpython/commit/dcc3eaef98cd94d6cb6cb0f44bd1c903d04f33b1 - https://github.com/python/cpython/commit/a77ab24427a18bff817025adb03ca920dc3f1a06 - https://github.com/python/cpython/commit/b2f11ca7667e4d57c71c1c88b255115f16042d9a - https://github.com/python/cpython/commit/d4ac921a4b081f7f996a5d2b101684b67ba0ed7f - https://github.com/pyt
15f16042d9a - https://github.com/python/cpython/commit/d4ac921a4b081f7f996a5d2b101684b67ba0ed7f - https://github.com/python/cpython/commit/d662e2db2605515a767f88ad48096b8ac623c774 - https://github.com/python/cpython/commit/44e458357fca05ca0ae2658d62c8c595b048b5ef