Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-25132 State: PUBLISHED Published: 2025-03-19T17:57:14.659Z Last Updated: 2025-07-23T17:37:05.459Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Problem Types: CWE-400 Description: A flaw was found in the Hive hibernation controller component of OpenShift Dedicated. The ClusterDeployment.hive.openshift.io/v1 resource can be created with the spec.installed field set to true, regardless of the installation status, and a positive timespan for the spec.hibernateAfter value. If a ClusterSync.hiveinternal.openshift.io/v1alpha1 resource is also created, the hive hibernation controller will enter the reconciliation loop leading to a panic when accessing a n
s also created, the hive hibernation controller will enter the reconciliation loop leading to a panic when accessing a non-existing field in the ClusterDeployment’s status section, resulting in a denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2024-25132 - https://bugzilla.redhat.com/show_bug.cgi?id=2260371
CVE ID: CVE-2024-25133 State: PUBLISHED Published: 2024-12-31T14:25:19.455Z Last Updated: 2025-08-27T13:01:11.634Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Problem Types: CWE-284 Description: A flaw was found in the Hive ClusterDeployments resource in OpenShift Dedicated. In certain conditions, this issue may allow a developer account on a Hive-enabled cluster to obtain cluster-admin privileges by executing arbitrary commands on the hive/hive-controllers pod. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2024-25133 - https://bugzilla.redhat.com/show_bug.cgi?id=2260372 - https://github.com/openshift/hi
.com/security/cve/CVE-2024-25133 - https://bugzilla.redhat.com/show_bug.cgi?id=2260372 - https://github.com/openshift/hive/pull/2306
CVE ID: CVE-2024-25136 State: PUBLISHED Published: 2024-03-26T22:53:41.589Z Last Updated: 2024-08-08T14:49:09.314Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: AutomationDirect Products: C-MORE EA9 HMI EA9-T6CL, C-MORE EA9 HMI EA9-T7CL, C-MORE EA9 HMI EA0-T7CL-R, C-MORE EA9 HMI EA9-T8CL, C-MORE EA9 HMI EA9-T10CL, C-MORE EA9 HMI EA9-T10WCL, C-MORE EA9 HMI EA9-T12CL, C-MORE EA9 HMI EA9-T15CL, C-MORE EA9 HMI EA9-T15CL-R, C-MORE EA9 HMI EA9-RHMI, C-MORE EA9 HMI EA9-PGMSW Problem Types: CWE-22 Description: There is a function in AutomationDirect C-MORE EA9 HMI that allows an attacker to send a relative path in the URL without proper sanitizing of the content. Ad
t C-MORE EA9 HMI that allows an attacker to send a relative path in the URL without proper sanitizing of the content. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://https://www.cisa.gov/news-events/ics-advisories/icsa-24-086-01
CVE ID: CVE-2024-25137 State: PUBLISHED Published: 2024-03-26T22:58:44.753Z Last Updated: 2024-08-01T23:36:21.635Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: AutomationDirect Products: C-MORE EA9 HMI EA9-T6CL, C-MORE EA9 HMI EA9-T7CL, C-MORE EA9 HMI EA0-T7CL-R, C-MORE EA9 HMI EA9-T8CL, C-MORE EA9 HMI EA9-T10CL, C-MORE EA9 HMI EA9-T10WCL, C-MORE EA9 HMI EA9-T12CL, C-MORE EA9 HMI EA9-T15CL, C-MORE EA9 HMI EA9-T15CL-R, C-MORE EA9 HMI EA9-RHMI, C-MORE EA9 HMI EA9-PGMSW Problem Types: CWE-121 Description: In AutomationDirect C-MORE EA9 HMI there is a program that copies a buffer of a size controlled by the user into a limited sized buffer on the stack which
there is a program that copies a buffer of a size controlled by the user into a limited sized buffer on the stack which may lead to a stack overflow. The result of this stack-based buffer overflow can lead to denial-of-service conditions. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://https://www.cisa.gov/news-events/ics-advisories/icsa-24-086-01
CVE ID: CVE-2024-25138 State: PUBLISHED Published: 2024-03-26T23:01:40.197Z Last Updated: 2024-08-02T18:55:41.344Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: AutomationDirect Products: C-MORE EA9 HMI EA9-T6CL, C-MORE EA9 HMI EA9-T7CL, C-MORE EA9 HMI EA0-T7CL-R, C-MORE EA9 HMI EA9-T8CL, C-MORE EA9 HMI EA9-T10CL, C-MORE EA9 HMI EA9-T10WCL, C-MORE EA9 HMI EA9-T12CL, C-MORE EA9 HMI EA9-T15CL, C-MORE EA9 HMI EA9-T15CL-R, C-MORE EA9 HMI EA9-RHMI, C-MORE EA9 HMI EA9-PGMSW Problem Types: CWE-256 Description: In AutomationDirect C-MORE EA9 HMI, credentials used by the platform are stored as plain text on the device. Additional Analyst Notes: - CVE Program Contai
credentials used by the platform are stored as plain text on the device. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://https://www.cisa.gov/news-events/ics-advisories/icsa-24-086-01
CVE ID: CVE-2024-25139 State: PUBLISHED Published: 2024-03-14T00:00:00 Last Updated: 2024-08-05T13:21:58.870Z Vendors: n/a Products: n/a Problem Types: n/a Description: In TP-Link Omada er605 1.0.1 through (v2.6) 2.2.3, a cloud-brd binary is susceptible to an integer overflow that leads to a heap-based buffer overflow. After heap shaping, an attacker can achieve code execution in the context of the cloud-brd binary that runs at the root level. This is fixed in ER605(UN)_v2_2.2.4 Build 020240119. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.tp-link.com/us/omada-sdn/ - https://github.com/microsoft/Microsoft-TP-Link-Research-Team
CVE ID: CVE-2024-25140 State: PUBLISHED Published: 2024-02-06T00:00:00 Last Updated: 2024-08-29T17:56:43.389Z Vendors: n/a Products: n/a Problem Types: n/a Description: A default installation of RustDesk 1.2.3 on Windows places a WDKTestCert certificate under Trusted Root Certification Authorities with Enhanced Key Usage of Code Signing (1.3.6.1.5.5.7.3.3), valid from 2023 until 2033. This is potentially unwanted, e.g., because there is no public documentation of security measures for the private key, and arbitrary software could be signed if the private key were to be compromised. NOTE: the vendor's position is "we do not have EV cert, so we use test cert as a workaround." Insertion into Tr
romised. NOTE: the vendor's position is "we do not have EV cert, so we use test cert as a workaround." Insertion into Trusted Root Certification Authorities was the originally intended behavior, and the UI ensured that the certificate installation step (checked by default) was visible to the user before proceeding with the product installation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://news.ycombinator.com/item?id=39256493 - https://github.com/rustdesk/rustdesk/discussions/6444 - https://serverfault.com/questions/837994
CVE ID: CVE-2024-25141 State: PUBLISHED Published: 2024-02-20T20:30:28.924Z Last Updated: 2025-02-13T17:40:48.227Z Vendors: Apache Software Foundation Products: Apache Airflow Mongo Provider Problem Types: CWE-295 Description: When ssl was enabled for Mongo Hook, default settings included "allow_insecure" which caused that certificates were not validated. This was unexpected and undocumented. Users are recommended to upgrade to version 4.0.0, which fixes this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/apache/airflow/pull/37214 - https://lists.apache.org/thread/sqgbfqngjmn45ommmrgj7hvs7fgspsgm - http://www.openwall.com/l
apache/airflow/pull/37214 - https://lists.apache.org/thread/sqgbfqngjmn45ommmrgj7hvs7fgspsgm - http://www.openwall.com/lists/oss-security/2024/02/20/5
CVE ID: CVE-2024-25142 State: PUBLISHED Published: 2024-06-14T08:25:35.633Z Last Updated: 2025-03-20T19:18:38.244Z Vendors: Apache Software Foundation Products: Apache Airflow Problem Types: CWE-525 Description: Use of Web Browser Cache Containing Sensitive Information vulnerability in Apache Airflow. Airflow did not return "Cache-Control" header for dynamic content, which in case of some browsers could result in potentially storing sensitive data in local cache of the browser. This issue affects Apache Airflow: before 2.9.2. Users are recommended to upgrade to version 2.9.2, which fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - http
2, which fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/apache/airflow/pull/39550 - https://lists.apache.org/thread/cg1j28lk0fhzthk0of1g7vy7p2n1j7nr
CVE ID: CVE-2024-25143 State: PUBLISHED Published: 2024-02-07T14:45:04.168Z Last Updated: 2024-10-02T15:29:27.818Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Liferay Products: DXP, Portal Problem Types: CWE-770 Description: The Document and Media widget In Liferay Portal 7.2.0 through 7.3.6, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 13, and older unsupported versions, does not limit resource consumption when generating a preview image, which allows remote authenticated users to cause a denial of service (memory consumption) via crafted PNG images. Additional Analyst Notes: - CVE Program Container: - C
a denial of service (memory consumption) via crafted PNG images. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25143
CVE ID: CVE-2024-25144 State: PUBLISHED Published: 2024-02-08T03:25:31.037Z Last Updated: 2024-10-02T15:31:02.494Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:N/A:L) Vendors: Liferay Products: Portal, DXP Problem Types: CWE-835 Description: The IFrame widget in Liferay Portal 7.2.0 through 7.4.3.26, and older unsupported versions, and Liferay DXP 7.4 before update 27, 7.3 before update 6, 7.2 before fix pack 19, and older unsupported versions does not check the URL of the IFrame, which allows remote authenticated users to cause a denial-of-service (DoS) via a self referencing IFrame. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References:
) via a self referencing IFrame. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25144
CVE ID: CVE-2024-25145 State: PUBLISHED Published: 2024-02-07T14:57:33.054Z Last Updated: 2024-08-22T19:00:34.686Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: Liferay Products: Portal, DXP Problem Types: CWE-79 Description: Stored cross-site scripting (XSS) vulnerability in the Portal Search module's Search Result app in Liferay Portal 7.2.0 through 7.4.3.11, and older unsupported versions, and Liferay DXP 7.4 before update 8, 7.3 before update 4, 7.2 before fix pack 17, and older unsupported versions allows remote authenticated users to inject arbitrary web script or HTML into the Search Result app's search result if highlighting is disabled by adding
to inject arbitrary web script or HTML into the Search Result app's search result if highlighting is disabled by adding any searchable content (e.g., blog, message board message, web content article) to the application. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25145
CVE ID: CVE-2024-25146 State: PUBLISHED Published: 2024-02-08T03:36:07.512Z Last Updated: 2025-05-15T19:40:55.792Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Liferay Products: Portal, DXP Problem Types: CWE-204 Description: Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 18, and older unsupported versions returns with different responses depending on whether a site does not exist or if the user does not have permission to access the site, which allows remote attackers to discover the existence of sites by enumerating URLs. This vulnerability occurs if locale.prepend.frien
mote attackers to discover the existence of sites by enumerating URLs. This vulnerability occurs if locale.prepend.friendly.url.style=2 and if a custom 404 page is used. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25146
CVE ID: CVE-2024-25147 State: PUBLISHED Published: 2024-02-21T01:16:21.256Z Last Updated: 2025-04-22T16:25:59.509Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: Liferay Products: Portal, DXP Problem Types: CWE-79 Description: Cross-site scripting (XSS) vulnerability in HtmlUtil.escapeJsLink in Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, and older unsupported versions allows remote attackers to inject arbitrary web script or HTML via crafted javascript: style links. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lif
ript: style links. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25147
CVE ID: CVE-2024-25148 State: PUBLISHED Published: 2024-02-08T03:43:14.148Z Last Updated: 2024-10-02T15:34:33.761Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: Liferay Products: Portal, DXP Problem Types: CWE-201 Description: In Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, and older unsupported versions the `doAsUserId` URL parameter may get leaked when creating linked content using the WYSIWYG editor and while impersonating a user. This may allow remote authenticated users to impersonate a user after accessing the linked content. Additional Analyst Notes: - CVE Prog
emote authenticated users to impersonate a user after accessing the linked content. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25148
CVE ID: CVE-2024-25149 State: PUBLISHED Published: 2024-02-20T07:00:19.650Z Last Updated: 2024-08-01T23:36:21.703Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: Liferay Products: Portal, DXP Problem Types: CWE-863 Description: Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, and older unsupported versions does not properly restrict membership of a child site when the "Limit membership to members of the parent site" option is enabled, which allows remote authenticated users to add users who are not a member of the parent site to a child site. The added user may obtain perm
authenticated users to add users who are not a member of the parent site to a child site. The added user may obtain permission to perform unauthorized actions in the child site. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25149
CVE ID: CVE-2024-25150 State: PUBLISHED Published: 2024-02-20T08:11:28.312Z Last Updated: 2024-08-01T23:36:21.623Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Liferay Products: Portal, DXP Problem Types: CWE-201 Description: Information disclosure vulnerability in the Control Panel in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before update 4, 7.2 before fix pack 19, and older unsupported versions allows remote authenticated users to obtain a user's full name from the page's title by enumerating user screen names. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https:/
ing user screen names. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25150
CVE ID: CVE-2024-25151 State: PUBLISHED Published: 2024-02-21T03:17:37.167Z Last Updated: 2024-08-01T23:36:21.643Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Liferay Products: Portal, DXP Problem Types: CWE-79 Description: The Calendar module in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, and older unsupported versions does not escape user supplied data in the default notification email template, which allows remote authenticated users to inject arbitrary web script or HTML via the title of a calendar event or the user's name. This may lead to a content spoofing o
arbitrary web script or HTML via the title of a calendar event or the user's name. This may lead to a content spoofing or cross-site scripting (XSS) attacks depending on the capability of the receiver's mail client. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25151
CVE ID: CVE-2024-25152 State: PUBLISHED Published: 2024-02-21T02:00:32.694Z Last Updated: 2024-08-26T16:52:06.441Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: Liferay Products: Portal, DXP Problem Types: CWE-79 Description: Stored cross-site scripting (XSS) vulnerability in Message Board widget in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 17, and older unsupported versions allows remote authenticated users to inject arbitrary web script or HTML via the filename of an attachment. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: -
the filename of an attachment. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25152
CVE ID: CVE-2024-25153 State: PUBLISHED Published: 2024-03-13T14:10:36.029Z Last Updated: 2025-09-19T12:46:03.155Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Fortra Products: FileCatalyst Problem Types: CWE-472 Description: A directory traversal within the ‘ftpservlet’ of the FileCatalyst Workflow Web Portal allows files to be uploaded outside of the intended ‘uploadtemp’ directory with a specially crafted POST request. In situations where a file is successfully uploaded to web portal’s DocumentRoot, specially crafted JSP files could be used to execute code, including web shells. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Contain
be used to execute code, including web shells. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.fortra.com/security/advisory/fi-2024-002 - https://filecatalyst.software/public/filecatalyst/Workflow/5.1.6.114/fcweb_releasenotes.html
CVE ID: CVE-2024-25154 State: PUBLISHED Published: 2024-03-13T14:13:56.214Z Last Updated: 2024-08-12T18:55:44.054Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Fortra Products: FileCatalyst Problem Types: CWE-22 Description: Improper URL validation leads to path traversal in FileCatalyst Direct 3.8.8 and earlier allowing an encoded payload to cause the web server to return files located outside of the web root which may lead to data leakage. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.fortra.com/security/advisory/fi-2024-003 - https://filecatalyst.software/public/filecatalyst/Direct/3.8.9.90/whatsn
/www.fortra.com/security/advisory/fi-2024-003 - https://filecatalyst.software/public/filecatalyst/Direct/3.8.9.90/whatsnew_direct.html
CVE ID: CVE-2024-25155 State: PUBLISHED Published: 2024-03-13T14:15:54.156Z Last Updated: 2024-08-01T23:36:21.639Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: Fortra Products: FileCatalyst Problem Types: CWE-79 Description: In FileCatalyst Direct 3.8.8 and earlier through 3.8.6, the web server does not properly sanitize illegal characters in a URL which is then displayed on a subsequent error page. A malicious actor could craft a URL which would then execute arbitrary code within an HTML script tag. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.fortra.com/security/advisory/fi-2024-003 - https://fileca
lnrichment: - CVE Program Container: References: - https://www.fortra.com/security/advisory/fi-2024-003 - https://filecatalyst.software/public/filecatalyst/Direct/3.8.9.90/whatsnew_direct.html
CVE ID: CVE-2024-25156 State: PUBLISHED Published: 2024-03-14T14:06:01.498Z Last Updated: 2024-08-01T23:36:21.753Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: Fortra Products: GoAnywhere MFT Problem Types: CWE-22 Description: A path traversal vulnerability exists in GoAnywhere MFT prior to 7.4.2 which allows attackers to circumvent endpoint-specific permission checks in the GoAnywhere Admin and Web Clients. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.fortra.com/security/advisory/fi-2024-004
CVE ID: CVE-2024-25157 State: PUBLISHED Published: 2024-08-14T15:04:10.987Z Last Updated: 2024-08-29T03:55:30.276Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N) Vendors: Fortra Products: GoAnywhere MFT Problem Types: CWE-303 Description: An authentication bypass vulnerability in GoAnywhere MFT prior to 7.6.0 allows Admin Users with access to the Agent Console to circumvent some permission checks when attempting to visit other pages. This could lead to unauthorized information disclosure or modification. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.fortra.com/security/advisories/product-security/fi-2024-009
CVE ID: CVE-2024-25164 State: PUBLISHED Published: 2024-03-04T00:00:00 Last Updated: 2024-08-16T15:54:59.977Z Vendors: n/a Products: n/a Problem Types: n/a Description: iA Path Traversal vulnerability exists in iDURAR v2.0.0, that allows unauthenticated attackers to expose sensitive files via the download functionality. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/idurar/idurar-erp-crm/tree/2.0.0/routes/erpRoutes/erpDownloadRouter.js - https://github.com/u32i/cve/tree/main/CVE-2024-25164
CVE ID: CVE-2024-25165 State: PUBLISHED Published: 2024-02-14T00:00:00 Last Updated: 2024-08-26T18:23:33.930Z Vendors: n/a Products: n/a Problem Types: n/a Description: A global-buffer-overflow vulnerability was found in SWFTools v0.9.2, in the function LineText at lib/swf5compiler.flex. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/matthiaskramm/swftools/issues/217
CVE ID: CVE-2024-25166 State: PUBLISHED Published: 2024-02-27T00:00:00 Last Updated: 2024-08-29T17:53:32.691Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in 71CMS v.1.0.0 allows a remote attacker to execute arbitrary code via the uploadfile action parameter in the controller.php file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/xiaocheng-keji/71cms/issues/1