Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-32839 State: PUBLISHED Published: 2024-11-13T01:54:45.475Z Last Updated: 2024-11-19T04:55:53.626Z Severity: HIGH (CVSS 7.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Ivanti Products: EPM Description: SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-EPM-November-2024-for-EPM-2024-and-EPM-2022
CVE ID: CVE-2024-32840 State: PUBLISHED Published: 2024-09-12T01:09:56.338Z Last Updated: 2024-09-12T21:20:02.605Z Severity: CRITICAL (CVSS 9.1 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Ivanti Products: EPM Description: An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-EPM-September-2024-for-EPM-2024-and-EPM-2022
CVE ID: CVE-2024-32841 State: PUBLISHED Published: 2024-11-13T01:54:45.386Z Last Updated: 2024-11-19T04:55:51.227Z Severity: HIGH (CVSS 7.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Ivanti Products: EPM Description: SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-EPM-November-2024-for-EPM-2024-and-EPM-2022
CVE ID: CVE-2024-32842 State: PUBLISHED Published: 2024-09-12T01:09:56.173Z Last Updated: 2024-09-12T21:13:06.489Z Severity: CRITICAL (CVSS 9.1 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Ivanti Products: EPM Description: An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-EPM-September-2024-for-EPM-2024-and-EPM-2022
CVE ID: CVE-2024-32843 State: PUBLISHED Published: 2024-09-12T01:09:56.230Z Last Updated: 2024-09-12T21:16:22.723Z Severity: CRITICAL (CVSS 9.1 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Ivanti Products: EPM Description: An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-EPM-September-2024-for-EPM-2024-and-EPM-2022
CVE ID: CVE-2024-32844 State: PUBLISHED Published: 2024-11-13T01:54:45.443Z Last Updated: 2024-11-19T04:56:02.536Z Severity: HIGH (CVSS 7.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Ivanti Products: EPM Description: SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-EPM-November-2024-for-EPM-2024-and-EPM-2022
CVE ID: CVE-2024-32845 State: PUBLISHED Published: 2024-09-12T01:09:56.175Z Last Updated: 2024-09-12T21:14:44.010Z Severity: CRITICAL (CVSS 9.1 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Ivanti Products: EPM Description: An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-EPM-September-2024-for-EPM-2024-and-EPM-2022
CVE ID: CVE-2024-32846 State: PUBLISHED Published: 2024-09-12T01:09:56.175Z Last Updated: 2024-09-12T21:15:08.269Z Severity: CRITICAL (CVSS 9.1 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Ivanti Products: EPM Description: An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-EPM-September-2024-for-EPM-2024-and-EPM-2022
CVE ID: CVE-2024-32847 State: PUBLISHED Published: 2024-11-13T01:54:45.408Z Last Updated: 2024-11-19T04:56:03.781Z Severity: HIGH (CVSS 7.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Ivanti Products: EPM Description: SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-EPM-November-2024-for-EPM-2024-and-EPM-2022
CVE ID: CVE-2024-32848 State: PUBLISHED Published: 2024-09-12T01:09:56.249Z Last Updated: 2024-09-12T21:18:06.645Z Severity: CRITICAL (CVSS 9.1 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Ivanti Products: EPM Description: An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-EPM-September-2024-for-EPM-2024-and-EPM-2022
CVE ID: CVE-2024-32849 State: PUBLISHED Published: 2024-06-10T21:17:50.957Z Last Updated: 2024-08-02T02:20:35.621Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Trend Micro, Inc. Products: Trend Micro Maximum Security (Consumer) Description: Trend Micro Security 17.x (Consumer) is vulnerable to a Privilege Escalation vulnerability that could allow a local attacker to unintentionally delete privileged Trend Micro files including its own. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://helpcenter.trendmicro.com/en-us/article/tmka-19175 - https://www.zerodayinitiative.com/advisories/ZDI-24-576/
CVE ID: CVE-2024-32850 State: PUBLISHED Published: 2024-05-31T01:33:32.849Z Last Updated: 2024-08-02T02:20:35.662Z Vendors: Seiko Solutions Inc. Products: SkyBridge MB-A100/MB-A110, SkyBridge BASIC MB-A130 Problem Types: Improper Neutralization of Special Elements used in a Command ('Command Injection') Description: Improper neutralization of special elements used in a command ('Command Injection') exists in SkyBridge MB-A100/MB-A110 firmware Ver. 4.2.2 and earlier and SkyBridge BASIC MB-A130 firmware Ver. 1.5.5 and earlier. If the remote monitoring and control function is enabled on the product, an attacker with access to the product may execute an arbitrary command or login to the product
enabled on the product, an attacker with access to the product may execute an arbitrary command or login to the product with the administrator privilege. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.seiko-sol.co.jp/archives/82992/ - https://jvn.jp/en/vu/JVNVU94872523/
CVE ID: CVE-2024-32852 State: PUBLISHED Published: 2024-07-02T06:57:01.964Z Last Updated: 2024-08-02T02:20:35.683Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Dell Products: PowerScale OneFS Problem Types: CWE-327 Description: Dell PowerScale OneFS versions 8.2.2.x through 9.7.0.0 contain use of a broken or risky cryptographic algorithm vulnerability. An unprivileged network malicious attacker could potentially exploit this vulnerability, leading to data leaks. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/en-us/000226569/dsa-2024-255-security-update-for-dell-powerscale-onefs-
References: - https://www.dell.com/support/kbdoc/en-us/000226569/dsa-2024-255-security-update-for-dell-powerscale-onefs-for-multiple-security-vulnerabilities
CVE ID: CVE-2024-32853 State: PUBLISHED Published: 2024-07-02T07:03:20.931Z Last Updated: 2024-08-02T02:20:35.609Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: Dell Products: PowerScale OneFS Problem Types: CWE-250 Description: Dell PowerScale OneFS versions 8.2.2.x through 9.7.0.2 contain an execution with unnecessary privileges vulnerability. A local low privileged attacker could potentially exploit this vulnerability, leading to escalation of privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/en-us/000226569/dsa-2024-255-security-update-for-dell-powerscale-onefs-for-m
ences: - https://www.dell.com/support/kbdoc/en-us/000226569/dsa-2024-255-security-update-for-dell-powerscale-onefs-for-multiple-security-vulnerabilities
CVE ID: CVE-2024-32854 State: PUBLISHED Published: 2024-07-02T07:08:29.778Z Last Updated: 2024-08-02T02:20:35.664Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Dell Products: PowerScale OneFS Problem Types: CWE-269 Description: Dell PowerScale OneFS versions 8.2.2.x through 9.8.0.0 contain an improper privilege management vulnerability. A local high privilege attacker could potentially exploit this vulnerability, leading to privilege escalation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/en-us/000226569/dsa-2024-255-security-update-for-dell-powerscale-onefs-for-multiple-secu
ps://www.dell.com/support/kbdoc/en-us/000226569/dsa-2024-255-security-update-for-dell-powerscale-onefs-for-multiple-security-vulnerabilities
CVE ID: CVE-2024-32855 State: PUBLISHED Published: 2024-06-25T04:06:39.172Z Last Updated: 2024-08-02T02:20:35.676Z Severity: LOW (CVSS 3.8 CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L) Vendors: Dell Products: CPG BIOS Problem Types: CWE-787 Description: Dell Client Platform BIOS contains an Out-of-bounds Write vulnerability in an externally developed component. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Information tampering. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/en-us/000225627/dsa-2024-123
CVE ID: CVE-2024-32856 State: PUBLISHED Published: 2024-06-13T11:51:03.183Z Last Updated: 2024-08-02T02:20:35.591Z Severity: MEDIUM (CVSS 5.1 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L) Vendors: Dell Products: CPG BIOS Problem Types: CWE-20 Description: Dell Client Platform BIOS contains an Improper Input Validation vulnerability in an externally developed component. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Information disclosure. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/en-us/000221745/dsa-2024-067
CVE ID: CVE-2024-32857 State: PUBLISHED Published: 2024-07-31T08:37:41.665Z Last Updated: 2024-08-01T17:48:37.004Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Dell Products: Dell Peripheral Manager Problem Types: CWE-427 Description: Dell Peripheral Manager, versions prior to 1.7.6, contain an uncontrolled search path element vulnerability. An attacker could potentially exploit this vulnerability through preloading malicious DLL or symbolic link exploitation, leading to arbitrary code execution and escalation of privilege Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000225474/dsa-2024-242
CVE ID: CVE-2024-32858 State: PUBLISHED Published: 2024-06-13T12:48:29.724Z Last Updated: 2024-08-02T02:20:35.666Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Dell Products: CPG BIOS Problem Types: CWE-20 Description: Dell Client Platform BIOS contains an Improper Input Validation vulnerability in an externally developed component. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/en-us/000223439/dsa-2024-124
CVE ID: CVE-2024-32859 State: PUBLISHED Published: 2024-06-13T12:39:41.863Z Last Updated: 2024-08-02T02:20:35.656Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Dell Products: CPG BIOS Problem Types: CWE-20 Description: Dell Client Platform BIOS contains an Improper Input Validation vulnerability in an externally developed component. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/en-us/000223439/dsa-2024-124
CVE ID: CVE-2024-32860 State: PUBLISHED Published: 2024-06-13T13:00:19.384Z Last Updated: 2024-08-02T02:20:35.674Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Dell Products: CPG BIOS Problem Types: CWE-20 Description: Dell Client Platform BIOS contains an Improper Input Validation vulnerability in an externally developed component. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/en-us/000223440/dsa-2024-125
CVE ID: CVE-2024-32861 State: PUBLISHED Published: 2024-07-16T14:36:51.171Z Last Updated: 2025-07-21T15:57:46.437Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Johnson Controls Products: Software House C•CURE 9000 Installer Problem Types: CWE-276 Description: Under certain circumstances the impacted Software House C•CURE 9000 installer will utilize unnecessarily wide permissions. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories - https://www.cisa.gov/news-events/ics-advisories/ICSA-24-191-05
CVE ID: CVE-2024-32862 State: PUBLISHED Published: 2024-08-01T21:57:13.093Z Last Updated: 2024-08-02T14:58:44.835Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: Johnson Controls Products: exacqVision Problem Types: CWE-942 Description: Under certain circumstances the ExacqVision Web Services does not provide sufficient protection from untrusted domains. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories - https://www.cisa.gov/news-events/ics-advisories/icsa-24-214-02
CVE ID: CVE-2024-32863 State: PUBLISHED Published: 2024-08-01T20:59:34.089Z Last Updated: 2024-08-02T14:59:25.751Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: Johnson Controls Products: exacqVision Problem Types: CWE-352 Description: Under certain circumstances the exacqVision Web Services may be susceptible to Cross-Site Request Forgery (CSRF) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories - https://www.cisa.gov/news-events/ics-advisories/icsa-24-214-03
CVE ID: CVE-2024-32864 State: PUBLISHED Published: 2024-08-01T21:08:02.220Z Last Updated: 2024-08-05T19:10:10.819Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: Johnson Controls Products: exacqVision Problem Types: CWE-319 Description: Under certain circumstances exacqVision Web Services will not enforce secure web communications (HTTPS) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories - https://www.cisa.gov/news-events/ics-advisories/icsa-24-214-04
CVE ID: CVE-2024-32865 State: PUBLISHED Published: 2024-08-01T21:13:24.868Z Last Updated: 2024-08-02T14:36:24.920Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: Johnson Controls Products: exacqVision Problem Types: CWE-295 Description: Under certain circumstances the exacqVision Server will not properly validate TLS certificates provided by connected devices. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories - https://www.cisa.gov/news-events/ics-advisories/icsa-24-214-05
CVE ID: CVE-2024-32866 State: PUBLISHED Published: 2024-04-23T21:07:06.216Z Last Updated: 2024-08-02T02:20:35.639Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H) Vendors: edmundhung Products: conform Problem Types: CWE-1321 Description: Conform, a type-safe form validation library, allows the parsing of nested objects in the form of `object.property`. Due to an improper implementation of this feature in versions prior to 1.1.1, an attacker can exploit the feature to trigger prototype pollution by passing a crafted input to `parseWith...` functions. Applications that use conform for server-side validation of form data or URL parameters are affected by this vulnerabilit
pplications that use conform for server-side validation of form data or URL parameters are affected by this vulnerability. Version 1.1.1 contains a patch for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/edmundhung/conform/security/advisories/GHSA-624g-8qjg-8qxf - https://github.com/edmundhung/conform/commit/4819d51b5a53fd5486fc85c17cdc148eb160e3de - https://github.com/edmundhung/conform/blob/59156d7115a7207fa3b6f8a70a4342a9b24c2501/packages/conform-dom/formdata.ts#L117
CVE ID: CVE-2024-32867 State: PUBLISHED Published: 2024-05-07T15:06:58.326Z Last Updated: 2024-08-02T02:20:35.604Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: OISF Products: suricata Problem Types: CWE-754 Description: Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.5 and 6.0.19, various problems in handling of fragmentation anomalies can lead to mis-detection of rules and policy. This vulnerability is fixed in 7.0.5 or 6.0.19. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/OISF/suricata/security/advisories/GHSA
CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/OISF/suricata/security/advisories/GHSA-xvrx-88mv-xcq5 - https://github.com/OISF/suricata/commit/1e110d0a71db46571040b937e17a4bc9f91d6de9 - https://github.com/OISF/suricata/commit/2f39ba75f153ba9bdf8eedc2a839cc973dbaea66 - https://github.com/OISF/suricata/commit/414f97c6695c5a2e1d378a36a6f50d7288767634 - https://github.com/OISF/suricata/commit/bf3d420fb709ebe074019a99e3bd3a2364524a4b - https://github.com/OISF/suricata/commit/d13bd2ae217a6d2ceb347f74d27cbfcd37b9bda9 - https://github.com/OISF/suricata/commit/e6267758ed5da27f804f0c1c07f9423bdf4d72b8 - https://redmine.openinfosecfoundation.org/issues/6672 - https://
icata/commit/e6267758ed5da27f804f0c1c07f9423bdf4d72b8 - https://redmine.openinfosecfoundation.org/issues/6672 - https://redmine.openinfosecfoundation.org/issues/6673 - https://redmine.openinfosecfoundation.org/issues/6677
CVE ID: CVE-2024-32868 State: PUBLISHED Published: 2024-04-25T23:53:37.235Z Last Updated: 2024-08-05T16:54:00.249Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: zitadel Products: zitadel Problem Types: CWE-307, CWE-297 Description: ZITADEL provides users the possibility to use Time-based One-Time-Password (TOTP) and One-Time-Password (OTP) through SMS and Email. While ZITADEL already gives administrators the option to define a `Lockout Policy` with a maximum amount of failed password check attempts, there was no such mechanism for (T)OTP checks. This issue has been patched in version 2.50.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vul
checks. This issue has been patched in version 2.50.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/zitadel/zitadel/security/advisories/GHSA-7j7j-66cv-m239 - https://github.com/zitadel/zitadel/releases/tag/v2.50.0
CVE ID: CVE-2024-32869 State: PUBLISHED Published: 2024-04-23T20:20:44.908Z Last Updated: 2024-08-02T02:20:35.658Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: honojs Products: hono Problem Types: CWE-22 Description: Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.2.7, when using serveStatic with deno, it is possible to traverse the directory where `main.ts` is located. This can result in retrieval of unexpected files. Version 4.2.7 contains a patch for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/honojs/hono/security/advisor
t Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/honojs/hono/security/advisories/GHSA-3mpf-rcc7-5347 - https://github.com/honojs/hono/commit/92e65fbb6e5e7372650e7690dbd84938432d9e65
CVE ID: CVE-2024-32870 State: PUBLISHED Published: 2024-11-04T23:36:46.265Z Last Updated: 2024-11-05T16:26:44.887Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N) Vendors: Combodo Products: iTop Problem Types: CWE-200 Description: Combodo iTop is a simple, web based IT Service Management tool. Server, OS, DBMS, PHP, and iTop info (name, version and parameters) can be read by anyone having access to iTop URI. This issue has been patched in versions 2.7.11, 3.0.5, 3.1.2, and 3.2.0. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Combodo/iTop/security
vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Combodo/iTop/security/advisories/GHSA-rfjh-2f5x-qxmx
CVE ID: CVE-2024-32871 State: PUBLISHED Published: 2024-06-04T14:43:20.796Z Last Updated: 2024-08-02T02:20:35.642Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: pimcore Products: pimcore Problem Types: CWE-770 Description: Pimcore is an Open Source Data & Experience Management Platform. The Pimcore thumbnail generation can be used to flood the server with large files. By changing the file extension or scaling factor of the requested thumbnail, attackers can create files that are much larger in file size than the original. This vulnerability is fixed in 11.2.4. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://g
is fixed in 11.2.4. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/pimcore/pimcore/security/advisories/GHSA-277c-5vvj-9pwx - https://github.com/pimcore/pimcore/commit/38af70b3130f16fc27f2aea34e2943d7bdaaba06 - https://github.com/pimcore/pimcore/commit/a6821a16ea38086bf6012e682e1743488244bd85