Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-8755 State: PUBLISHED Published: 2024-10-11T14:19:45.909Z Last Updated: 2024-11-15T20:05:53.028Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Progress Products: LoadMaster Problem Types: CWE-20 Description: Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows : OS Command Injection.This issue affects: Product Affected Versions LoadMaster From 7.2.55.0 to 7.2.60.1 (inclusive) From 7.2.49.0 to 7.2.54.12 (inclusive) 7.2.48.12 and all prior versions Multi-Tenant Hypervisor 7.1.35.12 and all prior versions ECS All prior versions to 7.2.60.1 (inclusive) Additional Analyst Notes: - CISA ADP Vulnrichment: Refe
ll prior versions ECS All prior versions to 7.2.60.1 (inclusive) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.kemptechnologies.com/hc/en-us/articles/30297374715661-LoadMaster-Security-Vulnerability-CVE-2024-8755
CVE ID: CVE-2024-8756 State: PUBLISHED Published: 2024-11-09T05:40:23.254Z Last Updated: 2024-11-12T18:40:56.811Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: ThemeCatcher Products: Quform - WordPress Form Builder Problem Types: CWE-200 Description: The Quform - WordPress Form Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.20.0 via the 'saveUploadedFile' function. This makes it possible for unauthenticated attackers to extract sensitive data, such as Personally Identifiable Information, from files uploaded by users. Files uploaded via forms created before version 2.21.0 will remain vuln
iable Information, from files uploaded by users. Files uploaded via forms created before version 2.21.0 will remain vulnerable to exposure after upgrading. To fully patch the plugin, site administrators should download any previously uploaded files, delete previously existing files and forms, and create the forms again after upgrading to version 2.21.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/beb8ea66-3cd7-452f-9e64-8439de0ddc55?source=cve - https://codecanyon.net/item/quform-wordpress-form-builder/706149
CVE ID: CVE-2024-8757 State: PUBLISHED Published: 2024-10-12T09:39:18.735Z Last Updated: 2024-10-15T14:43:43.797Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: afthemes Products: WP Post Author – Boost Your Blog&#039;s Engagement with Author Box, Social Links, Co-Authors, Guest Authors, Post Rating System, and Custom User Registration Form Builder Problem Types: CWE-89 Description: The WP Post Author – Boost Your Blog&#039;s Engagement with Author Box, Social Links, Co-Authors, Guest Authors, Post Rating System, and Custom User Registration Form Builder plugin for WordPress is vulnerable to time-based SQL Injection via the linked_user_id parameter in all ver
Form Builder plugin for WordPress is vulnerable to time-based SQL Injection via the linked_user_id parameter in all versions up to, and including, 3.8.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d667bafc-5f19-4889-a988-236df050c013?source=cve - https://github.com/GumGu
wordfence.com/threat-intel/vulnerabilities/id/d667bafc-5f19-4889-a988-236df050c013?source=cve - https://github.com/GumGumZz/wordpress/blob/main/wp-post-author.md - https://plugins.trac.wordpress.org/browser/wp-post-author/trunk/includes/multi-authors/wpa-multi-authors.php#L182 - https://plugins.trac.wordpress.org/changeset/3166002/wp-post-author/trunk/includes/multi-authors/wpa-multi-authors.php
CVE ID: CVE-2024-8758 State: PUBLISHED Published: 2024-09-23T06:00:05.005Z Last Updated: 2024-10-07T20:39:27.674Z Vendors: Unknown Products: Quiz and Survey Master (QSM) Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Quiz and Survey Master (QSM) WordPress plugin before 9.1.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/d74ecae2-3a1e-4fc7-9dd3-04cef631ecd9/
CVE ID: CVE-2024-8759 State: PUBLISHED Published: 2025-05-15T20:07:18.734Z Last Updated: 2025-05-17T03:03:43.262Z Vendors: Unknown Products: Nested Pages Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Nested Pages WordPress plugin before 3.2.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/3dd41ecb-d0dc-4c23-9e5b-b1f7fbaaddfd/
CVE ID: CVE-2024-8760 State: PUBLISHED Published: 2024-10-12T08:41:04.333Z Last Updated: 2024-10-15T15:07:56.743Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: bfintal Products: Stackable – Page Builder Gutenberg Blocks Problem Types: CWE-94 Description: The Stackable – Page Builder Gutenberg Blocks plugin for WordPress is vulnerable to CSS Injection in all versions up to, and including, 3.13.6. This makes it possible for unauthenticated attackers to embed untrusted style information into comments resulting in a possibility of data exfiltration such as admin nonces with limited impact. These nonces could be used to perform CSRF attacks within a limited tim
ration such as admin nonces with limited impact. These nonces could be used to perform CSRF attacks within a limited time window. The presence of other plugins may make additional nonces available, which may pose a risk in plugins that don't perform capability checks to protect AJAX actions or other actions reachable by lower-privileged users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1fd0b13c-7447-45da-9608-80b7629d9bbf?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3158674%40stackable-ultimate-gutenberg-blocks%2Ftrunk&old=3156448%40stackable-ultimate-gutenberg-blo
mail=&reponame=&new=3158674%40stackable-ultimate-gutenberg-blocks%2Ftrunk&old=3156448%40stackable-ultimate-gutenberg-blocks%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2024-8761 State: PUBLISHED Published: 2024-09-17T08:30:27.454Z Last Updated: 2024-09-17T13:46:04.820Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: mihail-barinov Products: Share This Image Problem Types: CWE-601 Description: The Share This Image plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 2.03. This is due to insufficient validation on the redirect url supplied via the link parameter. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action. Additional Analyst Notes: - CISA ADP Vulnrichment: Ref
es if they can successfully trick them into performing an action. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1e72d5c7-c601-4775-a825-4786bbd1b5f0?source=cve - https://wordpress.org/plugins/share-this-image/#developers - https://plugins.trac.wordpress.org/browser/share-this-image/tags/2.03/assets/js/sti.js#L693 - https://plugins.trac.wordpress.org/browser/share-this-image/tags/2.03/includes/class-sti-shortlink.php#L64 - https://plugins.trac.wordpress.org/browser/share-this-image/tags/2.03/includes/class-sti-shortlink.php#L74 - https://plugins.trac.wordpress.org/changeset/3152564/
CVE ID: CVE-2024-8762 State: PUBLISHED Published: 2024-09-13T00:31:06.160Z Last Updated: 2024-09-13T13:48:20.528Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: code-projects Products: Crud Operation System Problem Types: CWE-89 Description: A vulnerability was found in code-projects Crud Operation System 1.0. It has been classified as critical. This affects an unknown part of the file /updatedata.php. The manipulation of the argument sid leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.277341 - https://vuldb
y be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.277341 - https://vuldb.com/?ctiid.277341 - https://vuldb.com/?submit.406159 - https://github.com/Kangsiyuan/1/issues/1 - https://code-projects.org/
CVE ID: CVE-2024-8763 State: PUBLISHED Published: 2025-03-20T10:08:56.871Z Last Updated: 2025-10-15T12:50:42.043Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: lunary-ai Products: lunary-ai/lunary Problem Types: CWE-1333 Description: A Regular Expression Denial of Service (ReDoS) vulnerability exists in the lunary-ai/lunary repository, specifically in the compileTextTemplate function. The affected version is git be54057. An attacker can exploit this vulnerability by manipulating the regular expression /{{(.*?)}}/g, causing the server to hang indefinitely and become unresponsive to any requests. This is due to the regular expression's susceptibility to second
g indefinitely and become unresponsive to any requests. This is due to the regular expression's susceptibility to second-degree polynomial time complexity, which can be triggered by a large number of braces in the input. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/4fb63a6e-0056-4550-a34d-e161de1c13b8 - https://github.com/lunary-ai/lunary/commit/7ff89b0304d191534b924cf063f3648206d497fa
CVE ID: CVE-2024-8764 State: PUBLISHED Published: 2025-03-20T10:09:36.827Z Last Updated: 2025-10-15T12:49:57.655Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: lunary-ai Products: lunary-ai/lunary Problem Types: CWE-1333 Description: A vulnerability in lunary-ai/lunary, as of commit be54057, allows users to upload and execute arbitrary regular expressions on the server side. This can lead to a Denial of Service (DoS) condition, as certain regular expressions can cause excessive resource consumption, blocking the server from processing other requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/088c04a1-d23a-47f
requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/088c04a1-d23a-47f2-9d7c-b84d7332868d - https://github.com/lunary-ai/lunary/commit/7ff89b0304d191534b924cf063f3648206d497fa
CVE ID: CVE-2024-8765 State: PUBLISHED Published: 2025-03-20T10:10:37.352Z Last Updated: 2025-03-20T18:19:01.463Z Severity: HIGH (CVSS 7.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: lunary-ai Products: lunary-ai/lunary Problem Types: CWE-41 Description: In lunary-ai/lunary, the privilege check mechanism is flawed in version git afc5df4. The system incorrectly identifies certain endpoints as public if the path contains '/auth/' anywhere within it. This allows unauthenticated attackers to access sensitive endpoints by including '/auth/' in the path. As a result, attackers can obtain and modify sensitive data and utilize other organizations' resources without proper authentication.
ttackers can obtain and modify sensitive data and utilize other organizations' resources without proper authentication. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/4908cfcf-607a-412a-9635-966cbb08bb49 - https://github.com/lunary-ai/lunary/commit/7ff89b0304d191534b924cf063f3648206d497fa
CVE ID: CVE-2024-8766 State: PUBLISHED Published: 2024-09-16T19:45:03.044Z Last Updated: 2025-01-02T15:25:36.040Z Severity: MEDIUM (CVSS 6.7 CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Acronis Products: Acronis Cyber Protect Cloud Agent, Acronis Cyber Protect 16 Problem Types: CWE-427 Description: Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 38235, Acronis Cyber Protect 16 (Windows) before build 39169. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security-advisory.acronis.com/advisories/SEC-7218
CVE ID: CVE-2024-8767 State: PUBLISHED Published: 2024-09-17T08:51:28.954Z Last Updated: 2024-09-17T13:43:37.687Z Severity: CRITICAL (CVSS 9.9 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Acronis Products: Acronis Backup plugin for cPanel & WHM, Acronis Backup extension for Plesk, Acronis Backup plugin for DirectAdmin Problem Types: CWE-250 Description: Sensitive data disclosure and manipulation due to unnecessary privileges assignment. The following products are affected: Acronis Backup plugin for cPanel & WHM (Linux) before build 619, Acronis Backup extension for Plesk (Linux) before build 555, Acronis Backup plugin for DirectAdmin (Linux) before build 147. Additional Analyst Not
r Plesk (Linux) before build 555, Acronis Backup plugin for DirectAdmin (Linux) before build 147. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security-advisory.acronis.com/advisories/SEC-4976
CVE ID: CVE-2024-8768 State: PUBLISHED Published: 2024-09-17T16:20:42.399Z Last Updated: 2025-11-20T07:34:23.311Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux AI (RHEL AI) Problem Types: CWE-617 Description: A flaw was found in the vLLM library. A completions API request with an empty prompt will crash the vLLM API server, resulting in a denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2024-8768 - https://bugzilla.redhat.com/show_bug.cgi?id=2311895 - https://github.com/vllm-project/vllm/issues/7632 - https://github.com/vllm-project/vllm/p
.com/show_bug.cgi?id=2311895 - https://github.com/vllm-project/vllm/issues/7632 - https://github.com/vllm-project/vllm/pull/7746
CVE ID: CVE-2024-8769 State: PUBLISHED Published: 2025-03-20T10:11:22.123Z Last Updated: 2025-10-15T12:50:42.461Z Severity: CRITICAL (CVSS 9.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) Vendors: aimhubio Products: aimhubio/aim Problem Types: CWE-22 Description: A vulnerability in the `LockManager.release_locks` function in aimhubio/aim (commit bb76afe) allows for arbitrary file deletion through relative path traversal. The `run_hash` parameter, which is user-controllable, is concatenated without normalization as part of a path used to specify file deletion. This vulnerability is exposed through the `Repo._close_run()` method, which is accessible via the tracking server instruction API. As
ility is exposed through the `Repo._close_run()` method, which is accessible via the tracking server instruction API. As a result, an attacker can exploit this to delete any arbitrary file on the machine running the tracking server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/59d3472f-f581-4beb-a090-afd36a00ecf7
CVE ID: CVE-2024-8770 State: PUBLISHED Published: 2024-09-23T20:09:01.746Z Last Updated: 2024-09-23T20:37:07.272Z Vendors: GitHub Products: GitHub Enterprise Server Problem Types: CWE-79 Description: A Cross-Site Scripting (XSS) vulnerability was identified in the repository transfer feature of GitHub Enterprise Server, which allows attackers to steal sensitive user information via social engineering. This vulnerability affected all versions of GitHub Enterprise Server and was fixed in version 3.10.17, 3.11.15, 3.12.9, 3.13.4, and 3.14.1. This vulnerability was reported via the GitHub Bug Bounty program. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.github.com
the GitHub Bug Bounty program. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.github.com/en/enterprise-server@3.14/admin/release-notes#3.14.1 - https://docs.github.com/en/enterprise-server@3.13/admin/release-notes#3.13.4 - https://docs.github.com/en/enterprise-server@3.12/admin/release-notes#3.12.9 - https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.15 - https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.17
CVE ID: CVE-2024-8771 State: PUBLISHED Published: 2024-09-26T15:30:33.922Z Last Updated: 2024-09-26T15:50:39.039Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: icegram Products: Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce Problem Types: CWE-862 Description: The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'preview_email_template_design' function in all versions up to, and including, 5.7.34. This makes it possible for authentic
eview_email_template_design' function in all versions up to, and including, 5.7.34. This makes it possible for authenticated attackers, with Subscriber-level access and above, to extract sensitive data including the content of private, password protected, pending, and draft posts and pages. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f9d90717-fd48-493b-9293-32976bf2cada?source=cve - https://plugins.trac.wordpress.org/browser/email-subscribers/trunk/lite/admin/class-email-subscribers-admin.php#L1754 - https://plugins.trac.wordpress.org/changeset/3157336/
CVE ID: CVE-2024-8772 State: PUBLISHED Published: 2024-11-26T07:24:27.026Z Last Updated: 2025-03-28T07:16:28.604Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: Axis Communications AB Products: AXIS OS Problem Types: CWE-1286 Description: 51l3nc3, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API managedoverlayimages.cgi was vulnerable to a race condition attack allowing for an attacker to block access to the overlay configuration page in the web interface of the Axis device. This flaw can only be exploited after authenticating with an operator- or administrator-privileged service account. Axis has released patched AXIS OS versions for
nticating with an operator- or administrator-privileged service account. Axis has released patched AXIS OS versions for the highlighted flaw. Please refer to the Axis security advisory for more information and solution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.axis.com/dam/public/permalink/231072/cve-2024-8772pdf-en-US_InternalID-231072.pdf
CVE ID: CVE-2024-8773 State: PUBLISHED Published: 2025-03-24T12:33:15.769Z Last Updated: 2025-03-24T13:02:52.846Z Vendors: Simple SA Products: SIMPLE.ERP Problem Types: CWE-757 Description: SIMPLE.ERP client is vulnerable to MS SQL protocol downgrade request from a server side, what could lead to an unencrypted communication vulnerable to data interception and modification. This issue affect SIMPLE.ERP from 6.20 to 6.30. Only the 6.30 version received a patch 6.30@a03.9, which make it possible for an administrator to enforce encrypted communication. Versions 6.20 and 6.25 remain unpatched. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.pl/en/posts/2025/03/CVE-2
emain unpatched. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.pl/en/posts/2025/03/CVE-2024-8773/ - https://cert.pl/posts/2025/03/CVE-2024-8773/ - https://simple.com.pl/produkty/simple-erp/dla-kogo/
CVE ID: CVE-2024-8774 State: PUBLISHED Published: 2025-03-24T12:34:44.074Z Last Updated: 2025-03-24T13:02:21.414Z Vendors: Simple SA Products: SIMPLE.ERP Problem Types: CWE-257 Description: The SIMPLE.ERP client stores superuser password in a recoverable format, allowing any authenticated SIMPLE.ERP user to escalate privileges to a database administrator. This issue affect SIMPLE.ERP from 6.20 through 6.30. Only the 6.30 version received a patch 6.30@a03.9, which removed the vulnerability. Versions 6.20 and 6.25 remain unpatched. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.pl/en/posts/2025/03/CVE-2024-8773/ - https://cert.pl/posts/2025/03/CVE-2024-8773/ - ht
hment: References: - https://cert.pl/en/posts/2025/03/CVE-2024-8773/ - https://cert.pl/posts/2025/03/CVE-2024-8773/ - https://simple.com.pl/produkty/simple-erp/dla-kogo/
CVE ID: CVE-2024-8775 State: PUBLISHED Published: 2024-09-14T02:15:14.907Z Last Updated: 2025-11-06T23:17:04.821Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Red Hat Products: Ansible Automation Platform Execution Environments, Discovery 1 for RHEL 9, Red Hat Ansible Automation Platform 2.4 for RHEL 8, Red Hat Ansible Automation Platform 2.4 for RHEL 9, Red Hat Ansible Automation Platform 2.5 for RHEL 8, Red Hat Ansible Automation Platform 2.5 for RHEL 9, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux AI (RHEL AI) Problem Types: CWE-532 Description: A flaw was found in Ansible, where sensitive information stored in Ansible Vault files can be expos
CWE-532 Description: A flaw was found in Ansible, where sensitive information stored in Ansible Vault files can be exposed in plaintext during the execution of a playbook. This occurs when using tasks such as include_vars to load vaulted variables without setting the no_log: true parameter, resulting in sensitive data being printed in the playbook output or logs. This can lead to the unintentional disclosure of secrets like passwords or API keys, compromising security and potentially allowing unauthorized access or actions. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2024:10762 - https://access.redhat.com/err
- CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2024:10762 - https://access.redhat.com/errata/RHSA-2024:8969 - https://access.redhat.com/errata/RHSA-2024:9894 - https://access.redhat.com/errata/RHSA-2025:1249 - https://access.redhat.com/security/cve/CVE-2024-8775 - https://bugzilla.redhat.com/show_bug.cgi?id=2312119 - https://github.com/advisories/GHSA-jpxc-vmjf-9fcj
CVE ID: CVE-2024-8776 State: PUBLISHED Published: 2024-09-16T05:39:59.200Z Last Updated: 2024-09-16T13:06:09.757Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: INTUMIT Products: SmartRobot Problem Types: CWE-79 Description: SmartRobot from INTUMIT does not properly validate a specific page parameter, allowing unautheticated remote attackers to inject JavaScript code to the parameter for Reflected Cross-site Scripting attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-8069-73393-1.html - https://www.twcert.org.tw/en/cp-139-8070-d10bc-2.html
CVE ID: CVE-2024-8777 State: PUBLISHED Published: 2024-09-16T05:44:58.426Z Last Updated: 2024-09-16T13:53:24.712Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: The SYSCOM Group Products: OMFLOW Problem Types: CWE-200 Description: OMFLOW from The SYSCOM Group has an information leakage vulnerability, allowing unauthorized remote attackers to read arbitrary system configurations. If LDAP authentication is enabled, attackers can obtain plaintext credentials. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-8071-46589-1.html - https://www.twcert.org.tw/en/cp-139-8072-928a5-2.html