Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-50591 State: PUBLISHED Published: 2024-11-08T12:01:18.862Z Last Updated: 2025-11-03T22:28:28.503Z Vendors: HASOMED Products: Elefant Software Updater Problem Types: CWE-77 Description: An attacker with local access the to medical office computer can escalate his Windows user privileges to "NT AUTHORITY\SYSTEM" by exploiting a command injection vulnerability in the Elefant Update Service. The command injection can be exploited by communicating with the Elefant Update Service which is running as "SYSTEM" via Windows Named Pipes.The Elefant Software Updater (ESU) consists of two components. An ESU service which runs as "NT AUTHORITY\SYSTEM" and an ESU tray client which communic
SU) consists of two components. An ESU service which runs as "NT AUTHORITY\SYSTEM" and an ESU tray client which communicates with the service to update or repair the installation and is running with user permissions. The communication is implemented using named pipes. A crafted message of type "MessageType.SupportServiceInfos" can be sent to the local ESU service to inject commands, which are then executed as "NT AUTHORITY\SYSTEM". Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://r.sec-consult.com/hasomed - https://hasomed.de/produkte/elefant/
CVE ID: CVE-2024-50592 State: PUBLISHED Published: 2024-11-08T12:15:25.835Z Last Updated: 2025-11-03T22:28:29.966Z Vendors: HASOMED Products: Elefant Software Updater Problem Types: CWE-367 Description: An attacker with local access the to medical office computer can escalate his Windows user privileges to "NT AUTHORITY\SYSTEM" by exploiting a race condition in the Elefant Update Service during the repair or update process. When using the repair function, the service queries the server for a list of files and their hashes. In addition, instructions to execute binaries to finalize the repair process are included. The executables are executed as "NT AUTHORITY\SYSTEM" after they are copied over
nalize the repair process are included. The executables are executed as "NT AUTHORITY\SYSTEM" after they are copied over to the user writable installation folder (C:\Elefant1). This means that a user can overwrite either "PostESUUpdate.exe" or "Update_OpenJava.exe" in the time frame after the copy and before the execution of the final repair step. The overwritten executable is then executed as "NT AUTHORITY\SYSTEM". Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://r.sec-consult.com/hasomed - https://hasomed.de/produkte/elefant/
CVE ID: CVE-2024-50593 State: PUBLISHED Published: 2024-11-08T12:06:28.619Z Last Updated: 2025-11-03T22:28:31.428Z Vendors: HASOMED Products: Elefant Problem Types: CWE-798 Description: An attacker with local access to the medical office computer can access restricted functions of the Elefant Service tool by using a hard-coded "Hotline" password in the Elefant service binary, which is shipped with the software. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://r.sec-consult.com/hasomed - https://hasomed.de/produkte/elefant/
CVE ID: CVE-2024-50594 State: PUBLISHED Published: 2025-04-02T13:41:56.253Z Last Updated: 2025-11-03T19:31:51.151Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: STMicroelectronics Products: X-CUBE-AZRT-H7RS, X-CUBE-AZRTOS-F4, X-CUBE-AZRTOS-F7, X-CUBE-AZRTOS-G0, X-CUBE-AZRTOS-G4, X-CUBE-AZRTOS-H7, X-CUBE-AZRTOS-L4, X-CUBE-AZRTOS-L5, X-CUBE-AZRTOS-WB, X-CUBE-AZRTOS-WL Problem Types: CWE-191 Description: An integer underflow vulnerability exists in the HTTP server PUT request functionality of STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0. A specially crafted series of network requests can lead to denial of service. An attacker can send a sequence of malicious pac
ially crafted series of network requests can lead to denial of service. An attacker can send a sequence of malicious packets to trigger this vulnerability.This vulnerability affects the NetX Duo Web Component HTTP Server implementation which can be found in x-cube-azrtos-f7\Middlewares\ST\netxduo\addons\web\nx_web_http_server.c Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2024-2102
CVE ID: CVE-2024-50595 State: PUBLISHED Published: 2025-04-02T13:41:56.435Z Last Updated: 2025-11-03T19:31:52.516Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: STMicroelectronics Products: X-CUBE-AZRT-H7RS, X-CUBE-AZRTOS-F4, X-CUBE-AZRTOS-F7, X-CUBE-AZRTOS-G0, X-CUBE-AZRTOS-G4, X-CUBE-AZRTOS-H7, X-CUBE-AZRTOS-L4, X-CUBE-AZRTOS-L5, X-CUBE-AZRTOS-WB, X-CUBE-AZRTOS-WL Problem Types: CWE-191 Description: An integer underflow vulnerability exists in the HTTP server PUT request functionality of STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0. A specially crafted series of network requests can lead to denial of service. An attacker can send a sequence of malicious pac
ially crafted series of network requests can lead to denial of service. An attacker can send a sequence of malicious packets to trigger this vulnerability.This vulnerability affects the NetX Duo Component HTTP Server implementation which can be found in x-cube-azrtos-f7\Middlewares\ST\netxduo\addons\http\nxd_http_server.c Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2024-2102
CVE ID: CVE-2024-50596 State: PUBLISHED Published: 2025-04-02T13:41:55.311Z Last Updated: 2025-11-03T19:31:53.881Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: STMicroelectronics Products: X-CUBE-AZRT-H7RS, X-CUBE-AZRTOS-F4, X-CUBE-AZRTOS-F7, X-CUBE-AZRTOS-G0, X-CUBE-AZRTOS-G4, X-CUBE-AZRTOS-H7, X-CUBE-AZRTOS-L4, X-CUBE-AZRTOS-L5, X-CUBE-AZRTOS-WB, X-CUBE-AZRTOS-WL Problem Types: CWE-191 Description: An integer underflow vulnerability exists in the HTTP server PUT request functionality of STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0. A specially crafted network packet can lead to denial of service. An attacker can send a malicious packet to trigger this vuln
ially crafted network packet can lead to denial of service. An attacker can send a malicious packet to trigger this vulnerability.This vulnerability affects the NetX Duo Web Component HTTP Server implementation which can be found in x-cube-azrtos-f7\Middlewares\ST\netxduo\addons\web\nx_web_http_server.c Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2024-2103
CVE ID: CVE-2024-50597 State: PUBLISHED Published: 2025-04-02T13:41:55.517Z Last Updated: 2025-11-03T19:31:55.240Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: STMicroelectronics Products: X-CUBE-AZRT-H7RS, X-CUBE-AZRTOS-F4, X-CUBE-AZRTOS-F7, X-CUBE-AZRTOS-G0, X-CUBE-AZRTOS-G4, X-CUBE-AZRTOS-H7, X-CUBE-AZRTOS-L4, X-CUBE-AZRTOS-L5, X-CUBE-AZRTOS-WB, X-CUBE-AZRTOS-WL Problem Types: CWE-191 Description: An integer underflow vulnerability exists in the HTTP server PUT request functionality of STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0. A specially crafted network packet can lead to denial of service. An attacker can send a malicious packet to trigger this vuln
ially crafted network packet can lead to denial of service. An attacker can send a malicious packet to trigger this vulnerability.This vulnerability affects the NetX Duo Component HTTP Server implementation which can be found in x-cube-azrtos-f7\Middlewares\ST\netxduo\addons\http\nxd_http_server.c Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2024-2103
CVE ID: CVE-2024-50599 State: PUBLISHED Published: 2024-11-07T00:00:00 Last Updated: 2024-11-08T15:59:30.550Z Vendors: n/a Products: n/a Problem Types: n/a Description: A reflected Cross-Site Scripting (XSS) vulnerability has been identified in Zimbra Collaboration Suite (ZCS) 8.8.15, affecting one of the webmail calendar endpoints. This arises from improper handling of user-supplied input, allowing an attacker to inject malicious code that is reflected back in the HTML response. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories - https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P46#Security_Fixes
CVE ID: CVE-2024-50600 State: PUBLISHED Published: 2025-03-06T00:00:00.000Z Last Updated: 2025-03-07T15:05:03.853Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Samsung Mobile Processor and Wearable Processor Exynos 980, 850, 1080, 1280, 1330, 1380, 1480, W920, W930, and W1000. Lack of a boundary check in STOP_KEEP_ALIVE_OFFLOAD leads to out-of-bounds access. An attacker can send a malformed message to the target through the Wi-Fi driver. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://semiconductor.samsung.com/support/quality-support/product-security-updates/
CVE ID: CVE-2024-50601 State: PUBLISHED Published: 2024-11-11T00:00:00 Last Updated: 2024-11-12T15:54:01.976Z Vendors: n/a Products: n/a Problem Types: n/a Description: Persistent and reflected XSS vulnerabilities in the themeMode cookie and _h URL parameter of Axigen Mail Server up to version 10.5.28 allow attackers to execute arbitrary Javascript. Exploitation could lead to session hijacking, data leakage, and further exploitation via a multi-stage attack. Fixed in versions 10.3.3.67, 10.4.42, and 10.5.29. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.axigen.com/knowledgebase/Axigen-WebMail-Persistent-and-Reflected-XSS-Vulnerabilities-CVE-2024-50601-_403.html
CVE ID: CVE-2024-50602 State: PUBLISHED Published: 2024-10-27T00:00:00.000Z Last Updated: 2025-04-30T20:03:17.594Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in libexpat before 2.6.4. There is a crash within the XML_ResumeParser function because XML_StopParser can stop/suspend an unstarted parser. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/libexpat/libexpat/pull/915
CVE ID: CVE-2024-50603 State: PUBLISHED Published: 2025-01-08T00:00:00.000Z Last Updated: 2025-10-21T22:55:33.180Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Aviatrix Products: Controller Problem Types: CWE-78 Description: An issue was discovered in Aviatrix Controller before 7.1.4191 and 7.2.x before 7.2.4996. Due to the improper neutralization of special elements used in an OS command, an unauthenticated attacker is able to execute arbitrary code. Shell metacharacters can be sent to /v1/api in cloud_type for list_flightpath_destination_instances, or src_cloud_type for flightpath_connection_test. Additional Analyst Notes: - CISA ADP Vulnrichment: Refe
ion_instances, or src_cloud_type for flightpath_connection_test. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.aviatrix.com/documentation/latest/network-security/index.html - https://docs.aviatrix.com/documentation/latest/release-notices/psirt-advisories/psirt-advisories.html?expand=true#remote-code-execution-vulnerability-in-aviatrix-controllers - https://www.securing.pl/en/cve-2024-50603-aviatrix-network-controller-command-injection-vulnerability/
CVE ID: CVE-2024-50608 State: PUBLISHED Published: 2025-02-18T00:00:00.000Z Last Updated: 2025-02-19T15:00:24.262Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Fluent Bit 3.1.9. When the Prometheus Remote Write input plugin is running and listening on an IP address and port, one can send a packet with Content-Length: 0 and it crashes the server. Improper handling of the case when Content-Length is 0 allows a user (with access to the endpoint) to perform a remote Denial of service attack. The crash happens because of a NULL pointer dereference when 0 (from the Content-Length) is passed to the function cfl_sds_len, which in turn tries to cast a NULL poi
reference when 0 (from the Content-Length) is passed to the function cfl_sds_len, which in turn tries to cast a NULL pointer into struct cfl_sds. This is related to process_payload_metrics_ng() at prom_rw_prot.c. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fluentbit.io/announcements/ - https://github.com/fluent/fluent-bit/releases - https://www.ebryx.com/blogs/exploring-cve-2024-50608-and-cve-2024-50609
CVE ID: CVE-2024-50609 State: PUBLISHED Published: 2025-02-18T00:00:00.000Z Last Updated: 2025-02-19T14:58:22.328Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Fluent Bit 3.1.9. When the OpenTelemetry input plugin is running and listening on an IP address and port, one can send a packet with Content-Length: 0 and it crashes the server. Improper handling of the case when Content-Length is 0 allows a user (with access to the endpoint) to perform a remote Denial of service attack. The crash happens because of a NULL pointer dereference when 0 (from the Content-Length) is passed to the function cfl_sds_len, which in turn tries to cast a NULL pointer into
when 0 (from the Content-Length) is passed to the function cfl_sds_len, which in turn tries to cast a NULL pointer into struct cfl_sds. This is related to process_payload_traces_proto_ng() at opentelemetry_prot.c. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fluentbit.io/announcements/ - https://github.com/fluent/fluent-bit/releases - https://www.ebryx.com/blogs/exploring-cve-2024-50608-and-cve-2024-50609
CVE ID: CVE-2024-50610 State: PUBLISHED Published: 2024-10-27T00:00:00 Last Updated: 2024-10-30T18:13:40.086Z Vendors: n/a Products: n/a Problem Types: n/a Description: GSL (GNU Scientific Library) through 2.8 has an integer signedness error in gsl_siman_solve_many in siman/siman.c. When params.n_tries is negative, incorrect memory allocation occurs. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/silviadefra/GolDRuSh/blob/main/vulnerabilities/gsl.md - https://git.savannah.gnu.org/cgit/gsl.git/log/siman/siman.c - https://www.gnu.org/software/gsl/doc/html/siman.html
CVE ID: CVE-2024-50611 State: PUBLISHED Published: 2024-10-27T00:00:00 Last Updated: 2024-10-30T18:25:27.344Z Vendors: n/a Products: n/a Problem Types: n/a Description: CycloneDX cdxgen through 10.10.7, when run against an untrusted codebase, may execute code contained within build-related files such as build.gradle.kts, a similar issue to CVE-2022-24441. cdxgen is used by, for example, OWASP dep-scan. NOTE: this has been characterized as a design limitation, rather than an implementation mistake. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/CycloneDX/cdxgen/releases - https://github.com/CycloneDX/cdxgen/issues/1328 - https://owasp.org/www-project-dep-s
ub.com/CycloneDX/cdxgen/releases - https://github.com/CycloneDX/cdxgen/issues/1328 - https://owasp.org/www-project-dep-scan/
CVE ID: CVE-2024-50612 State: PUBLISHED Published: 2024-10-27T00:00:00 Last Updated: 2024-10-30T20:47:04.173Z Vendors: n/a Products: n/a Problem Types: n/a Description: libsndfile through 1.2.2 has an ogg_vorbis.c vorbis_analysis_wrote out-of-bounds read. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/libsndfile/libsndfile/issues/1035
CVE ID: CVE-2024-50613 State: PUBLISHED Published: 2024-10-27T00:00:00 Last Updated: 2024-10-30T19:13:18.634Z Vendors: n/a Products: n/a Problem Types: n/a Description: libsndfile through 1.2.2 has a reachable assertion, that may lead to application exit, in mpeg_l3_encode.c mpeg_l3_encoder_close. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/libsndfile/libsndfile/issues/1034
CVE ID: CVE-2024-50614 State: PUBLISHED Published: 2024-10-27T00:00:00 Last Updated: 2024-10-30T19:15:39.804Z Vendors: n/a Products: n/a Problem Types: n/a Description: TinyXML2 through 10.0.0 has a reachable assertion for UINT_MAX/16, that may lead to application exit, in tinyxml2.cpp XMLUtil::GetCharacterRef. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/leethomason/tinyxml2/issues/996
CVE ID: CVE-2024-50615 State: PUBLISHED Published: 2024-10-27T00:00:00 Last Updated: 2024-10-30T19:17:42.467Z Vendors: n/a Products: n/a Problem Types: n/a Description: TinyXML2 through 10.0.0 has a reachable assertion for UINT_MAX/digit, that may lead to application exit, in tinyxml2.cpp XMLUtil::GetCharacterRef. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/leethomason/tinyxml2/issues/997
CVE ID: CVE-2024-50616 State: PUBLISHED Published: 2024-10-27T00:00:00 Last Updated: 2024-10-30T19:56:39.111Z Vendors: n/a Products: n/a Problem Types: n/a Description: Ironman PowerShell Universal 5.x before 5.0.12 allows an authenticated attacker to elevate their privileges and view job information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.powershelluniversal.com/changelogs/cves#cve-tbd-10-17-2024-privilege-escalation-and-information-disclosure
CVE ID: CVE-2024-50623 State: PUBLISHED Published: 2024-10-27T00:00:00.000Z Last Updated: 2025-10-21T22:55:37.946Z Vendors: n/a Products: n/a Problem Types: CWE-434 Description: In Cleo Harmony before 5.8.0.21, VLTrader before 5.8.0.21, and LexiCom before 5.8.0.21, there is an unrestricted file upload and download that could lead to remote code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.cleo.com/hc/en-us/articles/27140294267799-Cleo-Product-Security-Advisory
CVE ID: CVE-2024-50624 State: PUBLISHED Published: 2024-10-27T00:00:00.000Z Last Updated: 2025-05-31T08:03:29.146Z Vendors: n/a Products: n/a Problem Types: n/a Description: ispdbservice.cpp in KDE Kmail before 6.2.0 allows man-in-the-middle attackers to trigger use of an attacker-controlled mail server because cleartext HTTP is used for a URL such as http://autoconfig.example.com or http://example.com/.well-known/autoconfig for retrieving the configuration. This is related to kmail-account-wizard. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugs.kde.org/show_bug.cgi?id=487882 - https://kde.org/announcements/megarelease/6/ - https://inven
References: - https://bugs.kde.org/show_bug.cgi?id=487882 - https://kde.org/announcements/megarelease/6/ - https://invent.kde.org/pim/kmail/-/tags - https://invent.kde.org/pim/kmail-account-wizard/-/commit/9784f5ab41c3aff435d4a88afb25585180a62ee4
CVE ID: CVE-2024-50625 State: PUBLISHED Published: 2024-12-09T00:00:00 Last Updated: 2024-12-11T20:52:29.818Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Digi ConnectPort LTS before 1.4.12. A vulnerability in the file upload handling of a web application allows manipulation of file paths via POST requests. This can lead to arbitrary file uploads within specific directories, potentially enabling privilege escalation when combined with other vulnerabilities. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.digi.com/resources/security - https://www.digi.com/resources/documentation/digidocs/pdfs/90001001.pdf - https://www.digi
digi.com/resources/security - https://www.digi.com/resources/documentation/digidocs/pdfs/90001001.pdf - https://www.digi.com/getattachment/Resources/Security/Alerts/Digi-ConnectPort-LTS-Firmware-Update/ConnectPort-LTS-KB.pdf
CVE ID: CVE-2024-50626 State: PUBLISHED Published: 2024-12-09T00:00:00 Last Updated: 2024-12-11T20:58:07.627Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Digi ConnectPort LTS before 1.4.12. A Directory Traversal vulnerability exists in WebFS. This allows an attacker on the local area network to manipulate URLs to include traversal sequences, potentially leading to unauthorized access to data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.digi.com/resources/security - https://www.digi.com/resources/documentation/digidocs/pdfs/90001001.pdf - https://www.digi.com/getattachment/Resources/Security/Alerts/Digi-ConnectPort-LTS
mentation/digidocs/pdfs/90001001.pdf - https://www.digi.com/getattachment/Resources/Security/Alerts/Digi-ConnectPort-LTS-Firmware-Update/ConnectPort-LTS-KB.pdf
CVE ID: CVE-2024-50627 State: PUBLISHED Published: 2024-12-09T00:00:00 Last Updated: 2024-12-11T16:32:40.063Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Digi ConnectPort LTS before 1.4.12. A Privilege Escalation vulnerability exists in the file upload feature. It allows an attacker on the local area network (with specific permissions) to upload and execute malicious files, potentially leading to unauthorized system access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.digi.com/resources/security - https://www.digi.com/resources/documentation/digidocs/pdfs/90001001.pdf - https://www.digi.com/getattachment/Resources/Secu
ps://www.digi.com/resources/documentation/digidocs/pdfs/90001001.pdf - https://www.digi.com/getattachment/Resources/Security/Alerts/Digi-ConnectPort-LTS-Firmware-Update/ConnectPort-LTS-KB.pdf
CVE ID: CVE-2024-50628 State: PUBLISHED Published: 2024-12-09T00:00:00 Last Updated: 2024-12-11T16:22:51.622Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the web services of Digi ConnectPort LTS before 1.4.12. It allows an attacker on the local area network to achieve unauthorized manipulation of resources, which may lead to remote code execution when combined with other issues. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.digi.com/resources/security - https://www.digi.com/resources/documentation/digidocs/pdfs/90001001.pdf - https://www.digi.com/getattachment/Resources/Security/Alerts/Digi-ConnectPort-LTS-Firmware-Upda
docs/pdfs/90001001.pdf - https://www.digi.com/getattachment/Resources/Security/Alerts/Digi-ConnectPort-LTS-Firmware-Update/ConnectPort-LTS-KB.pdf
CVE ID: CVE-2024-50629 State: PUBLISHED Published: 2025-03-19T05:49:56.438Z Last Updated: 2025-03-28T01:10:51.638Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Synology Products: DiskStation Manager (DSM), BeeStation OS (BSM) Problem Types: CWE-116 Description: Improper encoding or escaping of output vulnerability in the webapi component in Synology BeeStation OS (BSM) before 1.1-65374 and Synology DiskStation Manager (DSM) before 7.1.1-42962-7, 7.2-64570-4, 7.2.1-69057-6 and 7.2.2-72806-1 allow remote attackers to read limited files via unspecified vectors. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.synology.com/en-globa
unspecified vectors. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.synology.com/en-global/security/advisory/Synology_SA_24_20 - https://www.synology.com/en-global/security/advisory/Synology_SA_24_23
CVE ID: CVE-2024-50630 State: PUBLISHED Published: 2025-03-19T05:50:05.059Z Last Updated: 2025-03-19T14:41:45.451Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Synology Products: Synology Drive Server Problem Types: CWE-306 Description: Missing authentication for critical function vulnerability in the webapi component in Synology Drive Server before 3.0.4-12699, 3.2.1-23280, 3.5.0-26085 and 3.5.1-26102 allows remote attackers to obtain administrator credentials via unspecified vectors. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.synology.com/en-global/security/advisory/Synology_SA_24_21