Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-8049 State: PUBLISHED Published: 2024-11-13T15:20:32.209Z Last Updated: 2024-11-13T18:28:20.575Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Progress Software Products: Telerik Document Processing Libraries Problem Types: CWE-834 Description: In Progress Telerik Document Processing Libraries, versions prior to 2024 Q4 (2024.4.1106), importing a document with unsupported features can lead to excessive processing, leading to excessive use of computing resources leaving the application process unavailable. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.telerik.com/devtools/document-processing/knowledge-base/ex
st Notes: - CISA ADP Vulnrichment: References: - https://docs.telerik.com/devtools/document-processing/knowledge-base/excessive-allocation-cve-2024-8049
CVE ID: CVE-2024-8050 State: PUBLISHED Published: 2025-05-15T20:07:12.984Z Last Updated: 2025-05-20T19:20:46.133Z Vendors: Unknown Products: Custom Author Base Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Custom Author Base WordPress plugin through 1.1.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/28c9c127-464a-4750-8b62-a9b90b01f1af/
CVE ID: CVE-2024-8051 State: PUBLISHED Published: 2024-09-17T06:00:05.472Z Last Updated: 2024-09-17T14:18:08.922Z Vendors: Unknown Products: Special Feed Items Problem Types: CWE-79 Cross-Site Scripting (XSS), CWE-352 Cross-Site Request Forgery (CSRF) Description: The Special Feed Items WordPress plugin through 1.0.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/d5edf7ed-207c-48bb-9226-8647ad4348e4/
CVE ID: CVE-2024-8052 State: PUBLISHED Published: 2024-09-17T06:00:05.806Z Last Updated: 2024-09-17T14:56:34.186Z Vendors: Unknown Products: Review Ratings Problem Types: CWE-79 Cross-Site Scripting (XSS), CWE-352 Cross-Site Request Forgery (CSRF) Description: The Review Ratings WordPress plugin through 1.6 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/d821a6d0-d749-4e02-9b7c-3065e66e1c97/
CVE ID: CVE-2024-8053 State: PUBLISHED Published: 2025-03-20T10:11:13.561Z Last Updated: 2025-03-27T10:44:22.552Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: open-webui Products: open-webui/open-webui Problem Types: CWE-306 Description: In version v0.3.10 of open-webui/open-webui, the `api/v1/utils/pdf` endpoint lacks authentication mechanisms, allowing unauthenticated attackers to access the PDF generation service. This vulnerability can be exploited by sending a POST request with an excessively large payload, potentially leading to server resource exhaustion and denial of service (DoS). Additionally, unauthorized users can misuse the endpoint to generate
er resource exhaustion and denial of service (DoS). Additionally, unauthorized users can misuse the endpoint to generate PDFs without verification, resulting in service misuse and potential operational and financial impacts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/ebe8c1fa-113b-4df9-be03-a406b9adb9f4
CVE ID: CVE-2024-8054 State: PUBLISHED Published: 2024-09-12T06:00:06.875Z Last Updated: 2024-09-12T13:19:06.689Z Vendors: Unknown Products: MM-Breaking News Problem Types: CWE-352 Cross-Site Request Forgery (CSRF), CWE-79 Cross-Site Scripting (XSS) Description: The MM-Breaking News WordPress plugin through 0.7.9 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/f27deffc-9555-44bf-8dee-1891c210ecfd/
CVE ID: CVE-2024-8055 State: PUBLISHED Published: 2025-03-20T10:10:20.338Z Last Updated: 2025-10-15T12:50:38.587Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: vanna-ai Products: vanna-ai/vanna Problem Types: CWE-89 Description: Vanna v0.6.3 is vulnerable to SQL injection via Snowflake database in its file staging operations using the `PUT` and `COPY` commands. This vulnerability allows unauthenticated remote users to read arbitrary local files on the victim server, such as `/etc/passwd`, by exploiting the exposed SQL queries through a Python Flask API. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/7c92a611-6756-
on Flask API. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/7c92a611-6756-4885-8969-01d8b85b6c63
CVE ID: CVE-2024-8056 State: PUBLISHED Published: 2024-09-12T06:00:07.211Z Last Updated: 2024-09-12T12:59:34.191Z Vendors: Unknown Products: MM-Breaking News Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The MM-Breaking News WordPress plugin through 0.7.9 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/203b8122-f1e5-4e9e-ba83-f5cd59d8a289/
CVE ID: CVE-2024-8057 State: PUBLISHED Published: 2025-03-20T10:10:47.321Z Last Updated: 2025-10-15T12:49:55.152Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: danswer-ai Products: danswer-ai/danswer Problem Types: CWE-306 Description: In version 0.4.1 of danswer-ai/danswer, a vulnerability exists where a basic user can create credentials and link them to an existing connector. This issue arises because the system allows an unauthenticated attacker to sign up with a basic account and perform actions that should be restricted to admin users. This can lead to excessive resource consumption, potentially resulting in a Denial of Service (DoS) and other signifi
s. This can lead to excessive resource consumption, potentially resulting in a Denial of Service (DoS) and other significant issues, impacting the system's stability and security. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/b5991b98-a721-4acd-8ef2-980e15682913
CVE ID: CVE-2024-8058 State: PUBLISHED Published: 2024-12-16T17:04:30.539Z Last Updated: 2025-08-27T21:43:06.241Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L) Vendors: Lenovo Products: FileZ Client Problem Types: CWE-1287 Description: An improper parsing vulnerability was reported in the FileZ client that could allow a crafted file in the FileZ directory to read arbitrary files on the device due to URL preloading. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.filez.com/securityPolicy/1.html?1733849740
CVE ID: CVE-2024-8059 State: PUBLISHED Published: 2024-09-13T17:27:11.059Z Last Updated: 2024-09-13T17:55:08.750Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Lenovo Products: HX5530 Appliance (ThinkAgile) XCC, HX7530 Appliance (ThinkAgile) XCC, ST250 V3 (ThinkSystem) XCC, VX3331 Certified Node (ThinkAgile) XCC, HX Enclosure Certified Node (ThinkAgile) XCC, HX1021 Edge Certified Node 3yr (ThinkAgile) XCC, HX1320 Appliance (ThinkAgile) XCC, HX1321 Certified Node (ThinkAgile) XCC, HX1331 Certified Node (ThinkAgile) XCC, HX1520-R Appliance (ThinkAgile) XCC, HX1521-R Certified Node (ThinkAgile) XCC, HX2320-E Appliance (ThinkAgile) XCC, HX2321 Certified Node (
(ThinkAgile) XCC, HX1521-R Certified Node (ThinkAgile) XCC, HX2320-E Appliance (ThinkAgile) XCC, HX2321 Certified Node (ThinkAgile) XCC, HX2330 Appliance (ThinkAgile) XCC, HX2331 Certified Node (ThinkAgile) XCC, HX2720-E Appliance (ThinkAgile) XCC, HX3320 Appliance (ThinkAgile) XCC, HX3321 Certified Node (ThinkAgile) XCC, HX3330 Appliance (ThinkAgile) XCC, HX3331 Certified Node (ThinkAgile) XCC, HX3331 Node SAP HANA (ThinkAgile) XCC, HX3375 Appliance (ThinkAgile) XCC, HX3376 Certified Node (ThinkAgile) XCC, HX3520-G Appliance (ThinkAgile) XCC, HX3521-G Certified Node (ThinkAgile) XCC, HX3720 Appliance (ThinkAgile) XCC, HX3721 Certified Node (ThinkAgile) XCC, HX5520 Appliance (ThinkAgile) XCC
Agile) XCC, HX3720 Appliance (ThinkAgile) XCC, HX3721 Certified Node (ThinkAgile) XCC, HX5520 Appliance (ThinkAgile) XCC, HX5520-C Appliance (ThinkAgile) XCC, HX5521 Certified Node (ThinkAgile) XCC, HX5521-C Certified Node (ThinkAgile) XCC, HX5531 Certified Node (ThinkAgile) XCC, HX7520 Appliance (ThinkAgile) XCC, HX7521 Certified Node (ThinkAgile) XCC, HX7530 Appl for SAP HANA (ThinkAgile) XCC, HX7531 Certified Node (ThinkAgile) XCC, HX7531 Node SAP HANA (ThinkAgile) XCC, HX7820 Appliance (ThinkAgile) XCC, HX7821 Certified Node (ThinkAgile) XCC, MX Edge Appliance - MX1020 (ThinkAgile) XCC, MX3330-F All-flash Appliance (ThinkAgile) XCC, MX3330-H Hybrid Appliance (ThinkAgile) XCC, MX3331-F Al
(ThinkAgile) XCC, MX3330-F All-flash Appliance (ThinkAgile) XCC, MX3330-H Hybrid Appliance (ThinkAgile) XCC, MX3331-F All-flash Certified node (ThinkAgile) XCC, MX3331-H Hybrid Certified node (ThinkAgile) XCC, MX3530 F All flash Appliance (ThinkAgile) XCC, MX3530-H Hybrid Appliance (ThinkAgile) XCC, MX3531 H Hybrid Certified node (ThinkAgile) XCC, MX3531-F All-flash Certified node (ThinkAgile) XCC, P920 Rack Workstation (ThinkStation) XCC, SD530 (ThinkSystem) XCC, SD530 V3 (ThinkSystem) XCC, SD550 V3 (ThinkSystem) XCC, SD630 V2 (ThinkSystem) XCC, SD650 DWC Dual Node Tray (ThinkSystem) XCC, SD650 V2 (ThinkSystem) XCC, SD650 V3 (ThinkSystem) XCC, SD650-N V2 (ThinkSystem) XCC, SD665 V3 (ThinkSy
hinkSystem) XCC, SD650 V2 (ThinkSystem) XCC, SD650 V3 (ThinkSystem) XCC, SD650-N V2 (ThinkSystem) XCC, SD665 V3 (ThinkSystem) XCC, SE350 (ThinkSystem) XCC, SE350 V2 (ThinkEdge) XCC, SE360 V2 (ThinkEdge) XCC, SE450 (ThinkEdge) XCC, SE455 V3 (ThinkEdge) XCC, SN550 (ThinkSystem) XCC, SN550 V2 (ThinkSystem) XCC, SN850 (ThinkSystem) XCC, SR150 (ThinkSystem) XCC, SR158 (ThinkSystem) XCC, SR250 (ThinkSystem) XCC, SR250 V2 (ThinkSystem) XCC, SR250 V3 (ThinkSystem) XCC, SR258 (ThinkSystem) XCC, SR258 V2 (ThinkSystem) XCC, SR258 V3 (ThinkSystem) XCC, SR530 (ThinkSystem) XCC, SR550 (ThinkSystem) XCC, SR570 (ThinkSystem) XCC, SR590 (ThinkSystem) XCC, SR630 (ThinkSystem) XCC, SR630 V2 (ThinkSystem) XCC,
hinkSystem) XCC, SR570 (ThinkSystem) XCC, SR590 (ThinkSystem) XCC, SR630 (ThinkSystem) XCC, SR630 V2 (ThinkSystem) XCC, SR630 V3 (ThinkSystem) XCC, SR635 V3 (ThinkSystem) XCC, SR645 (ThinkSystem) XCC, SR645 V3 (ThinkSystem) XCC, SR650 (ThinkSystem) XCC, SR650 V2 (ThinkSystem) XCC, SR650 V3 (ThinkSystem) XCC, SR655 V3 (ThinkSystem) XCC, SR665 (ThinkSystem) XCC, SR665 V3 (ThinkSystem) XCC, SR670 (ThinkSystem) XCC, SR670 V2 (ThinkSystem) XCC, SR675 V3 (ThinkSystem) XCC, SR850 (ThinkSystem) XCC, SR850 V2 (ThinkSystem) XCC, SR850 V3 (ThinkSystem) XCC, SR850P (ThinkSystem) XCC, SR860 (ThinkSystem) XCC, SR860 V2 (ThinkSystem) XCC, SR860 V3 (ThinkSystem) XCC, SR950 (ThinkSystem) XCC, SR950 V3 (Think
R860 (ThinkSystem) XCC, SR860 V2 (ThinkSystem) XCC, SR860 V3 (ThinkSystem) XCC, SR950 (ThinkSystem) XCC, SR950 V3 (ThinkSystem) XCC, ST250 (ThinkSystem) XCC, ST250 V2 (ThinkSystem) XCC, ST258 (ThinkSystem) XCC, ST258 V2 (ThinkSystem) XCC, ST258 V3 (ThinkSystem) XCC, ST550 (ThinkSystem) XCC, ST650 V2 (ThinkSystem) XCC, ST650 V3 (ThinkSystem) XCC, ST658 V2 (ThinkSystem) XCC, ST658 V3 (ThinkSystem) XCC, ThinkAgile MX1021 on SE350 XCC, VX 1SE Certified Node (ThinkAgile) XCC, VX 2U4N Certified Node (ThinkAgile) XCC, VX 4U Certified Node (ThinkAgile) XCC, VX1320 (ThinkAgile) XCC, VX2320 (ThinkAgile) XCC, VX2330 Appliance (ThinkAgile) XCC, VX3320 (ThinkAgile) XCC, VX3330 Appliance (ThinkAgile) XCC,
VX2320 (ThinkAgile) XCC, VX2330 Appliance (ThinkAgile) XCC, VX3320 (ThinkAgile) XCC, VX3330 Appliance (ThinkAgile) XCC, VX3520-G (ThinkAgile) XCC, VX3530-G Appliance (ThinkAgile) XCC, VX3720 (ThinkAgile) XCC, VX5520 (ThinkAgile) XCC, VX5530 Appliance (ThinkAgile) XCC, VX635 V3 Integrated System (ThinkAgile) XCC, VX645 V3 Certified Node (ThinkAgile) XCC, VX645 V3 Integrated System (ThinkAgile) XCC, VX655 V3 Certified Node (ThinkAgile) XCC, VX655 V3 Integrated System (ThinkAgile) XCC, VX665 V3 Certified Node (ThinkAgile) XCC, VX665 V3 Integrated System (ThinkAgile) XCC, VX7320 N (ThinkAgile) XCC, VX7330 Appliance (Thinkagile) XCC, VX7520 (ThinkAgile) XCC, VX7520 N (ThinkAgile) XCC, VX7530 App
20 N (ThinkAgile) XCC, VX7330 Appliance (Thinkagile) XCC, VX7520 (ThinkAgile) XCC, VX7520 N (ThinkAgile) XCC, VX7530 Appliance (ThinkAgile) XCC, VX7531 Certified Node (ThinkAgile) XCC, VX7820 (ThinkAgile) XCC Problem Types: CWE-319 Description: IPMI credentials may be captured in XCC audit log entries when the account username length is 16 characters. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.lenovo.com/us/en/product_security/LEN-172051
CVE ID: CVE-2024-8060 State: PUBLISHED Published: 2025-03-20T10:09:48.839Z Last Updated: 2025-10-15T12:50:39.124Z Severity: HIGH (CVSS 8.1 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) Vendors: open-webui Products: open-webui/open-webui Problem Types: CWE-22 Description: OpenWebUI version 0.3.0 contains a vulnerability in the audio API endpoint `/audio/api/v1/transcriptions` that allows for arbitrary file upload. The application performs insufficient validation on the `file.content_type` and allows user-controlled filenames, leading to a path traversal vulnerability. This can be exploited by an authenticated user to overwrite critical files within the Docker container, potentially leading to
an be exploited by an authenticated user to overwrite critical files within the Docker container, potentially leading to remote code execution as the root user. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/a3b1a4b7-c723-496d-842c-844cc0988fe9
CVE ID: CVE-2024-8061 State: PUBLISHED Published: 2025-03-20T10:10:09.524Z Last Updated: 2025-10-15T12:49:55.677Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: aimhubio Products: aimhubio/aim Problem Types: CWE-1088 Description: In version 3.23.0 of aimhubio/aim, certain methods that request data from external servers do not have set timeouts, causing the server to wait indefinitely for a response. This can lead to a denial of service, as the tracking server does not respond to other requests while waiting. The issue arises in the client used by the `aim` tracking server to communicate with external resources, specifically in the `_run_read_instructions` met
ed by the `aim` tracking server to communicate with external resources, specifically in the `_run_read_instructions` method and similar calls without timeouts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/c85d005c-b354-4c51-a88f-adda2f09622b
CVE ID: CVE-2024-8062 State: PUBLISHED Published: 2025-03-20T10:11:04.864Z Last Updated: 2025-03-20T15:23:28.917Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: h2oai Products: h2oai/h2o-3 Problem Types: CWE-1088 Description: A vulnerability in the typeahead endpoint of h2oai/h2o-3 version 3.46.0 allows for a denial of service. The endpoint performs a `HEAD` request to verify the existence of a specified resource without setting a timeout. An attacker can exploit this by sending multiple requests to an attacker-controlled server that hangs, causing the application to block and become unresponsive to other requests. Additional Analyst Notes: - CISA ADP Vulnric
causing the application to block and become unresponsive to other requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/a04190d9-4acb-449a-9a7f-f1bf6be1ed23
CVE ID: CVE-2024-8063 State: PUBLISHED Published: 2025-03-20T10:10:56.139Z Last Updated: 2025-03-20T18:14:42.676Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: ollama Products: ollama/ollama Problem Types: CWE-369 Description: A divide by zero vulnerability exists in ollama/ollama version v0.3.3. The vulnerability occurs when importing GGUF models with a crafted type for `block_count` in the Modelfile. This can lead to a denial of service (DoS) condition when the server processes the model, causing it to crash. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/fd8e1ed6-21d2-4c9e-8395-2098f11b7db9
CVE ID: CVE-2024-8064 State: REJECTED Published: N/A Last Updated: 2024-08-30T15:31:16.933Z Description: No description available.
CVE ID: CVE-2024-8065 State: PUBLISHED Published: 2025-03-20T10:10:04.617Z Last Updated: 2025-03-20T14:31:35.789Z Severity: HIGH (CVSS 8.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H) Vendors: danswer-ai Products: danswer-ai/danswer Problem Types: CWE-352 Description: A Cross-Site Request Forgery (CSRF) vulnerability in version v1.4.1 of danswer-ai/danswer allows attackers to perform unauthorized actions in the context of the victim's browser. This includes connecting the victim's application with a malicious Slack Bot, inviting users, and deleting chats, among other actions. The application does not implement any CSRF protection, making it susceptible to these attacks. Additional Analyst N
ns. The application does not implement any CSRF protection, making it susceptible to these attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/61b58753-af36-43fd-b1b9-f3019532dd08
CVE ID: CVE-2024-8066 State: PUBLISHED Published: 2024-11-28T08:47:31.273Z Last Updated: 2025-01-06T17:45:20.183Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: ninjateam Products: File Manager Pro – Filester Problem Types: CWE-434 Description: The File Manager Pro – Filester plugin for WordPress is vulnerable to arbitrary file uploads due to missing validation in the 'fsConnector' function in all versions up to, and including, 1.8.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, and granted permissions by an Administrator, to upload a new .htaccess file allowing them to subsequently upload arbitrary files on the
issions by an Administrator, to upload a new .htaccess file allowing them to subsequently upload arbitrary files on the affected site's server which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/27288836-e5d3-49fc-b1f6-319ea3b70839?source=cve - https://plugins.trac.wordpress.org/browser/filester/trunk/includes/File_manager/FileManager.php#L269 - https://plugins.trac.wordpress.org/changeset/3186518/
CVE ID: CVE-2024-8067 State: PUBLISHED Published: 2024-09-24T15:53:35.042Z Last Updated: 2024-11-21T16:57:56.056Z Vendors: Helix Products: Helix Core Problem Types: CWE-176 Description: In versions of Helix Core prior to 2024.1 Patch 2 (2024.1/2655224) a Windows ANSI API Unicode "best fit" argument injection was identified. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://portal.perforce.com/s/detail/a91PA000001SXEzYAO
CVE ID: CVE-2024-8068 State: PUBLISHED Published: 2024-11-12T17:49:54.285Z Last Updated: 2025-10-21T22:55:37.320Z Vendors: Citrix Products: Citrix Session Recording Problem Types: CWE-269 Description: Privilege escalation to NetworkService Account access in Citrix Session Recording when an attacker is an authenticated user in the same Windows Active Directory domain as the session recording server domain Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.citrix.com/s/article/CTX691941-citrix-session-recording-security-bulletin-for-cve20248068-and-cve20248069?language=en_US
CVE ID: CVE-2024-8069 State: PUBLISHED Published: 2024-11-12T18:01:15.375Z Last Updated: 2025-10-21T22:55:36.857Z Vendors: Citrix Session Recording Products: Citrix Session Recording Problem Types: CWE-502 Description: Limited remote code execution with privilege of a NetworkService Account access in Citrix Session Recording if the attacker is an authenticated user on the same intranet as the session recording server Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.citrix.com/s/article/CTX691941-citrix-session-recording-security-bulletin-for-cve20248068-and-cve20248069?language=en_US
CVE ID: CVE-2024-8070 State: PUBLISHED Published: 2024-10-13T19:50:34.117Z Last Updated: 2024-10-14T15:01:07.649Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L) Vendors: Schneider Electric Products: EVlink Home Smart, Schneider Charge Problem Types: CWE-312 Description: CWE-312: Cleartext Storage of Sensitive Information vulnerability exists that exposes test credentials in the firmware binary Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-282-04&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-282-04.pdf
CVE ID: CVE-2024-8071 State: PUBLISHED Published: 2024-08-22T06:39:54.830Z Last Updated: 2024-08-22T13:33:55.204Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L) Vendors: Mattermost Products: Mattermost Problem Types: CWE-284 Description: Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0 and 9.8.x <= 9.8.2 fail to restrict which roles can promote a user as system admin which allows a System Role with edit access to the permissions section of system console to update their role (e.g. member) to include the `manage_system` permission, effectively becoming a System Admin. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://matterm
n, effectively becoming a System Admin. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2024-8072 State: PUBLISHED Published: 2024-08-22T07:52:52.184Z Last Updated: 2024-11-25T12:43:15.618Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Problem Types: CWE-200 Description: Mage AI allows remote unauthenticated attackers to leak the terminal server command history of arbitrary users Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://research.jfrog.com/vulnerabilities/mage-ai-terminal-server-infoleak-jfsa-2024-001039574/
CVE ID: CVE-2024-8073 State: PUBLISHED Published: 2024-08-26T02:19:48.164Z Last Updated: 2024-08-27T19:00:27.959Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Hillstone Networks Products: Hillstone Networks Web Application Firewall Problem Types: CWE-20 Description: Improper Input Validation vulnerability in Hillstone Networks Hillstone Networks Web Application Firewall on 5.5R6 allows Command Injection.This issue affects Hillstone Networks Web Application Firewall: from 5.5R6-2.6.7 through 5.5R6-2.8.13. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.hillstonenet.com.cn/security-notification/2024/08/21/mlzrld-2/
CVE ID: CVE-2024-8074 State: PUBLISHED Published: 2024-11-12T14:45:26.428Z Last Updated: 2025-10-14T13:05:10.020Z Vendors: Nomysoft Informatics Products: Nomysem Problem Types: CWE-306, CWE-862 Description: Missing Authentication for Critical Function, Missing Authorization vulnerability in Nomysoft Informatics Nomysem allows Collect Data as Provided by Users.This issue affects Nomysem: before 13.10.2024. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-24-1847