Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-46982 State: PUBLISHED Published: 2024-09-17T21:55:04.312Z Last Updated: 2024-09-18T13:45:21.409Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: vercel Products: next.js Problem Types: CWE-639 Description: Next.js is a React framework for building full-stack web applications. By sending a crafted HTTP request, it is possible to poison the cache of a non-dynamic server-side rendered route in the pages router (this does not affect the app router). When this crafted request is sent it could coerce Next.js to cache a route that is meant to not be cached and send a `Cache-Control: s-maxage=1, stale-while-revalidate` header which some upstream CDNs
is meant to not be cached and send a `Cache-Control: s-maxage=1, stale-while-revalidate` header which some upstream CDNs may cache as well. To be potentially affected all of the following must apply: 1. Next.js between 13.5.1 and 14.2.9, 2. Using pages router, & 3. Using non-dynamic server-side rendered routes e.g. `pages/dashboard.tsx` not `pages/blog/[slug].tsx`. This vulnerability was resolved in Next.js v13.5.7, v14.2.10, and later. We recommend upgrading regardless of whether you can reproduce the issue or not. There are no official or recommended workarounds for this issue, we recommend that users patch to a safe version. Additional Analyst Notes: - CISA ADP Vulnrichment: References: -
issue, we recommend that users patch to a safe version. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/vercel/next.js/security/advisories/GHSA-gp8f-8m3g-qvj9 - https://github.com/vercel/next.js/commit/7ed7f125e07ef0517a331009ed7e32691ba403d3 - https://github.com/vercel/next.js/commit/bd164d53af259c05f1ab434004bcfdd3837d7cda
CVE ID: CVE-2024-46983 State: PUBLISHED Published: 2024-09-19T22:47:14.438Z Last Updated: 2024-09-20T14:02:54.306Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: sofastack Products: sofa-hessian Problem Types: CWE-74 Description: sofa-hessian is an internal improved version of Hessian3/4 powered by Ant Group CO., Ltd. The SOFA Hessian protocol uses a blacklist mechanism to restrict deserialization of potentially dangerous classes for security protection. But there is a gadget chain that can bypass the SOFA Hessian blacklist protection mechanism, and this gadget chain only relies on JDK and does not rely on any third-party components. This issue is fixed b
chanism, and this gadget chain only relies on JDK and does not rely on any third-party components. This issue is fixed by an update to the blacklist, users can upgrade to sofahessian version 3.5.5 to avoid this issue. Users unable to upgrade may maintain a blacklist themselves in the directory `external/serialize.blacklist`. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/sofastack/sofa-hessian/security/advisories/GHSA-c459-2m73-67hj
CVE ID: CVE-2024-46984 State: PUBLISHED Published: 2024-09-19T22:38:21.169Z Last Updated: 2024-09-20T13:44:35.608Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: gematik Products: app-referencevalidator Problem Types: CWE-611 Description: The reference validator is a tool to perform advanced validation of FHIR resources for TI applications and interoperability standards. The profile location routine in the referencevalidator commons package is vulnerable to `XML External Entities` attack due to insecure defaults of the used Woodstox WstxInputFactory. A malicious XML resource can lead to network requests issued by referencevalidator and thus to a `Server Side
tFactory. A malicious XML resource can lead to network requests issued by referencevalidator and thus to a `Server Side Request Forgery` attack. The vulnerability impacts applications which use referencevalidator to process XML resources from untrusted sources. The problem has been patched with the 2.5.1 version of the referencevalidator. Users are strongly recommended to update to this version or a more recent one. A pre-processing or manual analysis of input XML resources on existence of DTD definitions or external entities can mitigate the problem. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/gematik/app-referencevalidator/security/advisories/GHSA-68
es: - CISA ADP Vulnrichment: References: - https://github.com/gematik/app-referencevalidator/security/advisories/GHSA-68j8-fp38-p48q - https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#transformerfactory - https://github.com/gematik/app-referencevalidator/releases/tag/2.5.1 - https://owasp.org/www-community/attacks/Server_Side_Request_Forgery - https://owasp.org/www-project-top-ten/2017/A4_2017-XML_External_Entities_(XXE) - https://owasp.org/www-project-top-ten/2017/A4_2017-XML_External_Entities_(XXE)#
CVE ID: CVE-2024-46985 State: PUBLISHED Published: 2024-09-23T15:12:21.539Z Last Updated: 2024-09-23T15:44:55.968Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: dataease Products: dataease Problem Types: CWE-611 Description: DataEase is an open source data visualization analysis tool. Prior to version 2.10.1, there is an XML external entity injection vulnerability in the static resource upload interface of DataEase. An attacker can construct a payload to implement intranet detection and file reading. The vulnerability has been fixed in v2.10.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/dataease/dataease/security/advi
0.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/dataease/dataease/security/advisories/GHSA-4m9p-7xg6-f4mm
CVE ID: CVE-2024-46986 State: PUBLISHED Published: 2024-09-18T17:14:09.127Z Last Updated: 2025-04-17T18:07:02.755Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: owen2345 Products: camaleon-cms Problem Types: CWE-74 Description: Camaleon CMS is a dynamic and advanced content management system based on Ruby on Rails. An arbitrary file write vulnerability accessible via the upload method of the MediaController allows authenticated users to write arbitrary files to any location on the web server Camaleon CMS is running on (depending on the permissions of the underlying filesystem). E.g. This can lead to a delayed remote code execution in case an attacker is a
ermissions of the underlying filesystem). E.g. This can lead to a delayed remote code execution in case an attacker is able to write a Ruby file into the config/initializers/ subfolder of the Ruby on Rails application. This issue has been addressed in release version 2.8.2. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/owen2345/camaleon-cms/security/advisories/GHSA-wmjg-vqhv-q5p5 - https://codeql.github.com/codeql-query-help/ruby/rb-path-injection - https://owasp.org/www-community/attacks/Path_Traversal - https://securitylab.github.com/advisories/GHSL-2024-182_GHSL-2024-
ps://owasp.org/www-community/attacks/Path_Traversal - https://securitylab.github.com/advisories/GHSL-2024-182_GHSL-2024-186_Camaleon_CMS - https://www.reddit.com/r/rails/comments/1exwtdm/camaleon_cms_281_has_been_released
CVE ID: CVE-2024-46987 State: PUBLISHED Published: 2024-09-18T17:15:45.829Z Last Updated: 2025-04-17T18:07:30.718Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: owen2345 Products: camaleon-cms Problem Types: CWE-200, CWE-22 Description: Camaleon CMS is a dynamic and advanced content management system based on Ruby on Rails. A path traversal vulnerability accessible via MediaController's download_private_file method allows authenticated users to download any file on the web server Camaleon CMS is running on (depending on the file permissions). This issue may lead to Information Disclosure. This issue has been addressed in release version 2.8.2. Users are advi
). This issue may lead to Information Disclosure. This issue has been addressed in release version 2.8.2. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/owen2345/camaleon-cms/security/advisories/GHSA-cp65-5m9r-vc2c - https://codeql.github.com/codeql-query-help/ruby/rb-path-injection - https://owasp.org/www-community/attacks/Path_Traversal - https://securitylab.github.com/advisories/GHSL-2024-182_GHSL-2024-186_Camaleon_CMS - https://www.reddit.com/r/rails/comments/1exwtdm/camaleon_cms_281_has_been_released
CVE ID: CVE-2024-46988 State: PUBLISHED Published: 2024-10-14T17:44:53.489Z Last Updated: 2024-10-15T15:40:00.721Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N) Vendors: Enalean Products: tuleap Problem Types: CWE-280 Description: Tuleap is a tool for end to end traceability of application and system developments. Prior to Tuleap Community Edition 15.13.99.40, Tuleap Enterprise Edition 15.13-3, and Tuleap Enterprise Edition 15.12-6, users might receive email notification with information they should not have access to. Tuleap Community Edition 15.13.99.40, Tuleap Enterprise Edition 15.13-3, and Tuleap Enterprise Edition 15.12-6 fix this issue. Additional Analyst No
13.99.40, Tuleap Enterprise Edition 15.13-3, and Tuleap Enterprise Edition 15.12-6 fix this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Enalean/tuleap/security/advisories/GHSA-g76g-hc92-96xw - https://tuleap.net/plugins/tracker/?aid=39686
CVE ID: CVE-2024-46989 State: PUBLISHED Published: 2024-09-18T17:29:06.456Z Last Updated: 2024-09-18T18:52:51.565Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: authzed Products: spicedb Problem Types: CWE-269 Description: spicedb is an Open Source, Google Zanzibar-inspired permissions database to enable fine-grained authorization for customer applications. Multiple caveats over the same indirect subject type on the same relation can result in no permission being returned when permission is expected. If the resource has multiple groups, and each group is caveated, it is possible for the returned permission to be "no permission" when permission is expected. Pe
each group is caveated, it is possible for the returned permission to be "no permission" when permission is expected. Permission is returned as NO_PERMISSION when PERMISSION is expected on the CheckPermission API. This issue has been addressed in release version 1.35.3. Users are advised to upgrade. Users unable to upgrade should not use caveats or avoid the use of caveats on an indirect subject type with multiple entries. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/authzed/spicedb/security/advisories/GHSA-jhg6-6qrx-38mr - https://github.com/authzed/spicedb/commit/d4ef8e1dbce1eafaf25847f4c0f09738820f5bf2
CVE ID: CVE-2024-46990 State: PUBLISHED Published: 2024-09-18T16:55:24.255Z Last Updated: 2024-09-18T18:19:24.086Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) Vendors: directus Products: directus Problem Types: CWE-284 Description: Directus is a real-time API and App dashboard for managing SQL database content. When relying on blocking access to localhost using the default `0.0.0.0` filter a user may bypass this block by using other registered loopback devices (like `127.0.0.2` - `127.127.127.127`). This issue has been addressed in release versions 10.13.3 and 11.1.0. Users are advised to upgrade. Users unable to upgrade may block this bypass by manually adding the
s 10.13.3 and 11.1.0. Users are advised to upgrade. Users unable to upgrade may block this bypass by manually adding the `127.0.0.0/8` CIDR range which will block access to any `127.X.X.X` ip instead of just `127.0.0.1`. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/directus/directus/security/advisories/GHSA-68g8-c275-xf2m - https://github.com/directus/directus/commit/4aace0bbe57232e38cd6a287ee475293e46dc91b - https://github.com/directus/directus/commit/769fa22797bff5a9231599883b391e013f122e52 - https://github.com/directus/directus/commit/8cbf943b65fd4a763d09a5fdbba8996b1e7797ff - https://github.com/directus/directus/commit/c1f3ccc681595038d094ce110ddeee
it/8cbf943b65fd4a763d09a5fdbba8996b1e7797ff - https://github.com/directus/directus/commit/c1f3ccc681595038d094ce110ddeee38cb38f431
CVE ID: CVE-2024-46992 State: PUBLISHED Published: 2025-07-01T01:43:13.767Z Last Updated: 2025-07-01T14:33:20.698Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: electron Products: electron Problem Types: CWE-354 Description: Electron is an open source framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. From versions 30.0.0-alpha.1 to before 30.0.5 and 31.0.0-alpha.1 to before 31.0.0-beta.1, Electron is vulnerable to an ASAR Integrity bypass. This only impacts apps that have the embeddedAsarIntegrityValidation and onlyLoadAppFromAsar fuses enabled. Apps without these fuses enabled are not impacted. This issue is specific
dation and onlyLoadAppFromAsar fuses enabled. Apps without these fuses enabled are not impacted. This issue is specific to Windows, apps using these fuses on macOS are not impacted. Specifically this issue can only be exploited if the app is launched from a filesystem the attacker has write access too. i.e. the ability to edit files inside the .app bundle on macOS which these fuses are supposed to protect against. This issue has been patched in versions 30.0.5 and 31.0.0-beta.1. There are no workarounds for this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/electron/electron/security/advisories/GHSA-xw5q-g62x-2qjc - https://www.electronjs.org/docs
rences: - https://github.com/electron/electron/security/advisories/GHSA-xw5q-g62x-2qjc - https://www.electronjs.org/docs/latest/tutorial/fuses
CVE ID: CVE-2024-46993 State: PUBLISHED Published: 2025-07-01T01:55:51.242Z Last Updated: 2025-07-02T13:25:00.677Z Vendors: electron Products: electron Problem Types: CWE-122 Description: Electron is an open source framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. In versions prior to 28.3.2, 29.3.3, and 30.0.3, the nativeImage.createFromPath() and nativeImage.createFromBuffer() functions call a function downstream that is vulnerable to a heap buffer overflow. An Electron program that uses either of the affected functions is vulnerable to a buffer overflow if an attacker is in control of the image's height, width, and contents. This issue has been patc
e to a buffer overflow if an attacker is in control of the image's height, width, and contents. This issue has been patched in versions 28.3.2, 29.3.3, and 30.0.3. There are no workarounds for this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/electron/electron/security/advisories/GHSA-6r2x-8pq8-9489
CVE ID: CVE-2024-46994 State: PUBLISHED Published: 2024-10-24T18:22:25.924Z Last Updated: 2024-10-24T19:23:55.028Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: baserproject Products: basercms Problem Types: CWE-79 Description: baserCMS is a website development framework. Versions prior to 5.1.2 have a cross-site scripting vulnerability in Blog posts and Contents list Feature. Version 5.1.2 fixes this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/baserproject/basercms/security/advisories/GHSA-wrjc-fmfq-w3jr - https://basercms.net/security/JVN_00876083
CVE ID: CVE-2024-46995 State: PUBLISHED Published: 2024-10-24T18:31:12.796Z Last Updated: 2024-10-24T19:23:24.838Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: baserproject Products: basercms Problem Types: CWE-79 Description: baserCMS is a website development framework. Versions prior to 5.1.2 have a cross-site scripting vulnerability in HTTP 400 Bad Request. Version 5.1.2 fixes this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/baserproject/basercms/security/advisories/GHSA-mr7q-fv7j-jcgv - https://basercms.net/security/JVN_06274755
CVE ID: CVE-2024-46996 State: PUBLISHED Published: 2024-10-24T18:35:21.088Z Last Updated: 2024-10-24T19:22:51.973Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N) Vendors: baserproject Products: basercms Problem Types: CWE-79 Description: baserCMS is a website development framework. Versions prior to 5.1.2 have a cross-site scripting vulnerability in the Blog posts feature. Version 5.1.2 fixes this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/baserproject/basercms/security/advisories/GHSA-66jv-qrm3-vvfg - https://basercms.net/security/JVN_00876083
CVE ID: CVE-2024-46997 State: PUBLISHED Published: 2024-09-23T15:14:26.550Z Last Updated: 2024-09-23T15:43:39.577Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: dataease Products: dataease Problem Types: CWE-74 Description: DataEase is an open source data visualization analysis tool. Prior to version 2.10.1, an attacker can achieve remote command execution by adding a carefully constructed h2 data source connection string. The vulnerability has been fixed in v2.10.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/dataease/dataease/security/advisories/GHSA-h7mj-m72h-qm8w
CVE ID: CVE-2024-46998 State: PUBLISHED Published: 2024-10-24T18:52:08.244Z Last Updated: 2024-10-24T20:01:26.743Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N) Vendors: baserproject Products: basercms Problem Types: CWE-79 Description: baserCMS is a website development framework. Versions prior to 5.1.2 have a cross-site scripting vulnerability in the Edit Email Form Settings Feature. Version 5.1.2 fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/baserproject/basercms/security/advisories/GHSA-p3m2-mj3j-j49x - https://basercms.net/security/JVN_98693329
CVE ID: CVE-2024-46999 State: PUBLISHED Published: 2024-09-19T23:11:48.256Z Last Updated: 2024-09-20T15:44:42.866Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N) Vendors: zitadel Products: zitadel Problem Types: CWE-269 Description: Zitadel is an open source identity management platform. ZITADEL's user grants deactivation mechanism did not work correctly. Deactivated user grants were still provided in token, which could lead to unauthorized access to applications and resources. Additionally, the management and auth API always returned the state as active or did not provide any information about the state. Versions 2.62.1, 2.61.1, 2.60.2, 2.59.3, 2.58.5, 2.57.5, 2.56.6
tive or did not provide any information about the state. Versions 2.62.1, 2.61.1, 2.60.2, 2.59.3, 2.58.5, 2.57.5, 2.56.6, 2.55.8, and 2.54.10 have been released which address this issue. Users are advised to upgrade. Users unable to upgrade may explicitly remove the user grants to make sure the user does not get access anymore. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/zitadel/zitadel/security/advisories/GHSA-2w5j-qfvw-2hf5
CVE ID: CVE-2024-47000 State: PUBLISHED Published: 2024-09-19T23:10:33.882Z Last Updated: 2024-09-20T15:42:00.168Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: zitadel Products: zitadel Problem Types: CWE-269 Description: Zitadel is an open source identity management platform. ZITADEL's user account deactivation mechanism did not work correctly with service accounts. Deactivated service accounts retained the ability to request tokens, which could lead to unauthorized access to applications and resources. Versions 2.62.1, 2.61.1, 2.60.2, 2.59.3, 2.58.5, 2.57.5, 2.56.6, 2.55.8, and 2.54.10 have been released which address this issue. Users are advised t upgra
59.3, 2.58.5, 2.57.5, 2.56.6, 2.55.8, and 2.54.10 have been released which address this issue. Users are advised t upgrade. Users unable to upgrade may instead of deactivating the service account, consider creating new credentials and replacing the old ones wherever they are used. This effectively prevents the deactivated service account from being utilized. Be sure to revoke all existing authentication keys associated with the service account and to rotate the service account's password. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/zitadel/zitadel/security/advisories/GHSA-qr2h-7pwm-h393
CVE ID: CVE-2024-47001 State: PUBLISHED Published: 2024-09-18T06:08:14.167Z Last Updated: 2024-09-18T15:23:18.923Z Vendors: TAKENAKA ENGINEERING CO., LTD. Products: HDVR-400, HDVR-800, HDVR-1600, AHD04T-A, AHD08T-A, AHD16T-A, NVR04T-A, NVR08T-A, NVR16T-A Problem Types: Hidden functionality Description: Hidden functionality issue in multiple digital video recorders provided by TAKENAKA ENGINEERING CO., LTD. allows a remote authenticated attacker to execute an arbitrary OS command on the device or alter the device settings. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.takex-eng.co.jp/ja/news/news.php?s=68 - https://jvn.jp/en/vu/JVNVU90142679/
CVE ID: CVE-2024-47002 State: PUBLISHED Published: 2025-01-15T14:59:29.089Z Last Updated: 2025-01-15T17:02:49.275Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N) Vendors: Observium Products: Observium Problem Types: CWE-79 Description: A html code injection vulnerability exists in the vlan management part of Observium CE 24.4.13528. A specially crafted HTTP request can lead to an arbitrary html code. An authenticated user would need to click a malicious link provided by the attacker. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2024-2091
CVE ID: CVE-2024-47003 State: PUBLISHED Published: 2024-09-26T08:05:16.392Z Last Updated: 2024-09-26T13:11:00.827Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: Mattermost Products: Mattermost Problem Types: CWE-400 Description: Mattermost versions 9.11.x <= 9.11.0 and 9.5.x <= 9.5.8 fail to validate that the message of the permalink post is a string, which allows an attacker to send a non-string value as the message of a permalink post and crash the frontend. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2024-47005 State: PUBLISHED Published: 2024-10-25T06:18:30.415Z Last Updated: 2024-10-25T18:38:02.777Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: Sharp Corporation, Toshiba Tec Corporation Products: Sharp Digital Full-color MFPs and Monochrome MFPs, e-STUDIO 908, e-STUDIO 1058, e-STUDIO 1208 Problem Types: CWE-749 Description: Sharp and Toshiba Tec MFPs provide configuration related APIs. They are expected to be called by administrative users only, but insufficiently restricted. A non-administrative user may execute some configuration APIs. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://jvn.jp/en/vu/JVNVU95063136/ - h
iguration APIs. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://jvn.jp/en/vu/JVNVU95063136/ - https://global.sharp/products/copier/info/info_security_2024-10.html - https://www.toshibatec.com/information/20241025_01.html
CVE ID: CVE-2024-47006 State: PUBLISHED Published: 2025-02-12T21:19:52.591Z Last Updated: 2025-02-18T19:55:25.622Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) RealSense D400 Series Problem Types: Escalation of Privilege, CWE-427 Description: Uncontrolled search path for the Intel(R) RealSense D400 Series Universal Windows Platform (UWP) Driver for Windows(R) 10 all versions may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01240.html