Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-32981 State: PUBLISHED Published: 2024-07-17T19:36:00.563Z Last Updated: 2024-08-02T02:27:53.196Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: silverstripe Products: silverstripe-framework Problem Types: CWE-79 Description: Silverstripe framework is the PHP framework forming the base for the Silverstripe CMS. In affected versions a bad actor with access to edit content in the CMS could add send a specifically crafted encoded payload to the server, which could be used to inject a JavaScript payload on the front end of the site. The payload would be sanitised on the client-side, but server-side sanitisation doesn't catch it. The server-side
site. The payload would be sanitised on the client-side, but server-side sanitisation doesn't catch it. The server-side sanitisation logic has been updated to sanitise against this type of attack in version 5.2.16. All users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/silverstripe/silverstripe-framework/security/advisories/GHSA-chx7-9x8h-r5mg - https://github.com/silverstripe/silverstripe-framework/commit/b8d20dc9d531550e06fd7da7a0eafa551922e2e1 - https://www.silverstripe.org/download/security-releases/cve-2024-32981
CVE ID: CVE-2024-32982 State: PUBLISHED Published: 2024-05-06T14:38:10.875Z Last Updated: 2024-08-02T02:27:53.331Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) Vendors: litestar-org Products: litestar Problem Types: CWE-22 Description: Litestar and Starlite is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to 2.8.3, 2.7.2, and 2.6.4, a Local File Inclusion (LFI) vulnerability has been discovered in the static file serving component of LiteStar. This vulnerability allows attackers to exploit path traversal flaws, enabling unauthorized access to sensitive files outside the designated directories. Such access can lead to the disclosure of sensitive in
zed access to sensitive files outside the designated directories. Such access can lead to the disclosure of sensitive information or potentially compromise the server. The vulnerability is located in the file path handling mechanism within the static content serving function, specifically at `litestar/static_files/base.py`. This vulnerability is fixed in versions 2.8.3, 2.7.2, and 2.6.4. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/litestar-org/litestar/security/advisories/GHSA-83pv-qr33-2vcf - https://github.com/litestar-org/litestar/commit/57e706e7effdc182fc9a2af5981bc88afb21851b - https://github.com/litestar-org/litestar/blob
om/litestar-org/litestar/commit/57e706e7effdc182fc9a2af5981bc88afb21851b - https://github.com/litestar-org/litestar/blob/main/litestar/static_files/base.py#L70
CVE ID: CVE-2024-32983 State: PUBLISHED Published: 2024-06-03T15:16:26.186Z Last Updated: 2024-08-02T02:27:53.540Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N) Vendors: misskey-dev Products: misskey Problem Types: CWE-863 Description: Misskey is an open source, decentralized microblogging platform. Misskey doesn't perform proper normalization on the JSON structures of incoming signed ActivityPub activity objects before processing them, allowing threat actors to spoof the contents of signed activities and impersonate the authors of the original activities. This vulnerability is fixed in 2024.5.0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Contai
vities. This vulnerability is fixed in 2024.5.0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/misskey-dev/misskey/security/advisories/GHSA-2vxv-pv3m-3wvj - https://github.com/misskey-dev/misskey/commit/d2a5bb39e344fcb84a24ae60faafe4694b227b88
CVE ID: CVE-2024-32984 State: PUBLISHED Published: 2024-05-01T10:45:09.357Z Last Updated: 2024-08-02T02:27:53.353Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: libp2p Products: rust-yamux Problem Types: CWE-400 Description: Yamux is a stream multiplexer over reliable, ordered connections such as TCP/IP. The Rust implementation of the Yamux stream multiplexer uses a vector for pending frames. This vector is not bounded in length. Every time the Yamux protocol requires sending of a new frame, this frame gets appended to this vector. This can be remotely triggered in a number of ways, for example by: 1. Opening a new libp2p Identify stream. This causes the nod
be remotely triggered in a number of ways, for example by: 1. Opening a new libp2p Identify stream. This causes the node to send its Identify message. Of course, every other protocol that causes the sending of data also works. The larger the response, the more data is enqueued. 2. Sending a Yamux Ping frame. This causes a Pong frame to be enqueued. Under normal circumstances, this queue of pending frames would be drained once they’re sent out over the network. However, the attacker can use TCP’s receive window mechanism to prevent the victim from sending out any data: By not reading from the TCP connection, the receive window will never be increased, and the victim won’t be able to send out
ot reading from the TCP connection, the receive window will never be increased, and the victim won’t be able to send out any new data (this is how TCP implements backpressure). Once this happens, Yamux’s queue of pending frames will start growing indefinitely. The queue will only be drained once the underlying TCP connection is closed. An attacker can cause a remote node to run out of memory, which will result in the corresponding process getting terminated by the operating system. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/libp2p/rust-yamux/security/advisories/GHSA-3999-5ffv-wp2r - https://github.com/sigp/rust-yamux/commit/66
ps://github.com/libp2p/rust-yamux/security/advisories/GHSA-3999-5ffv-wp2r - https://github.com/sigp/rust-yamux/commit/6689e227a48258a52347cd1d984adfc94afc6f7a - https://github.com/libp2p/rust-yamux/blob/yamux-v0.13.1/yamux/src/connection.rs#L289
CVE ID: CVE-2024-32985 State: PUBLISHED Published: 2024-05-09T20:54:15.065Z Last Updated: 2024-08-02T02:27:53.266Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: stellar Products: stellar-core Problem Types: CWE-362 Description: Stellar-core is a reference implementation for the peer-to-peer agent that manages the Stellar network. Prior to 20.4.0, core nodes could be randomly crashed due to a race condition with a 3rd party library. The likelihood of affecting the network is low since crashed nodes come back up online right away. Code fix mitigation is part of Stellar-core v20.4.0 release Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Cont
mitigation is part of Stellar-core v20.4.0 release Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/stellar/stellar-core/security/advisories/GHSA-mgx8-frjx-x33m
CVE ID: CVE-2024-32986 State: PUBLISHED Published: 2024-05-03T09:58:32.506Z Last Updated: 2024-08-02T02:27:53.340Z Severity: CRITICAL (CVSS 9.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: filips123 Products: PWAsForFirefox Problem Types: CWE-74, CWE-93, CWE-150 Description: PWAsForFirefox is a tool to install, manage and use Progressive Web Apps (PWAs) in Mozilla Firefox. Due to improper sanitization of web app properties (such as name, description, shortcuts), web apps were able to inject additional lines into XDG Desktop Entries (on Linux) and `AppInfo.ini` (on PortableApps.com). This allowed malicious web apps to introduce keys like `Exec`, which could run arbitrary code when t
PortableApps.com). This allowed malicious web apps to introduce keys like `Exec`, which could run arbitrary code when the affected web app was launched. This vulnerability affects all Linux and PortableApps.com users of all PWAsForFirefox versions up to (excluding) 2.12.0. Windows and macOS users are not affected. This vulnerability has been fixed in commit `9932d4b` which has been included in release in v2.12.0. The main fix is implemented in the native part, but the extension also contains additional fixes. All Linux and PortableApps.com users are advised to update to this version as soon as possible. It is also recommended for Windows and macOS users to update to this version, as it cont
is version as soon as possible. It is also recommended for Windows and macOS users to update to this version, as it contains additional fixes related to properties sanitization. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/filips123/PWAsForFirefox/security/advisories/GHSA-jmhv-m7v5-g5jq - https://github.com/filips123/PWAsForFirefox/commit/9932d4b289631d447f88ace09a2fabafe4cd5bd5 - https://github.com/filips123/PWAsForFirefox/releases/tag/v2.12.0
CVE ID: CVE-2024-32987 State: PUBLISHED Published: 2024-07-09T17:02:40.032Z Last Updated: 2025-10-14T22:13:23.365Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, Microsoft SharePoint Server Subscription Edition Problem Types: CWE-918 Description: Microsoft SharePoint Server Information Disclosure Vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-32987
CVE ID: CVE-2024-32988 State: PUBLISHED Published: 2024-05-22T07:37:32.362Z Last Updated: 2024-08-02T02:27:53.227Z Vendors: i-plug inc. Products: 'OfferBox' App for Android, 'OfferBox' App for iOS Problem Types: Use of Hard-coded Cryptographic Key Description: 'OfferBox' App for Android versions 2.0.0 to 2.3.17 and 'OfferBox' App for iOS versions 2.1.7 to 2.6.14 use a hard-coded secret key for JWT. Secret key for JWT may be retrieved if the application binary is reverse-engineered. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://jvn.jp/en/jp/JVN83405304/
CVE ID: CVE-2024-32989 State: PUBLISHED Published: 2024-05-11T09:42:32.952Z Last Updated: 2024-08-02T02:27:53.535Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: Huawei Products: HarmonyOS, EMUI Problem Types: CWE-20 Description: Insufficient verification vulnerability in the system sharing pop-up module Impact: Successful exploitation of this vulnerability will affect availability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://consumer.huawei.com/en/support/bulletin/2024/5/ - https://device.harmonyos.com/cn/docs/security/update/security-bulletins-phones-202405-0000001902628049 - https://consumer.huawei.com/e
.harmonyos.com/cn/docs/security/update/security-bulletins-phones-202405-0000001902628049 - https://consumer.huawei.com/en/support/bulletin/2024/6/
CVE ID: CVE-2024-32990 State: PUBLISHED Published: 2024-05-11T09:44:25.800Z Last Updated: 2024-08-02T02:27:53.380Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H) Vendors: Huawei Products: HarmonyOS, EMUI Problem Types: CWE-20 Description: Permission verification vulnerability in the system sharing pop-up module Impact: Successful exploitation of this vulnerability will affect availability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://consumer.huawei.com/en/support/bulletin/2024/5/ - https://device.harmonyos.com/cn/docs/security/update/security-bulletins-phones-202405-0000001902628049 - https://consumer.huawei.com/
e.harmonyos.com/cn/docs/security/update/security-bulletins-phones-202405-0000001902628049 - https://consumer.huawei.com/en/support/bulletin/2024/6/
CVE ID: CVE-2024-32991 State: PUBLISHED Published: 2024-05-11T09:46:46.963Z Last Updated: 2024-08-02T02:27:53.346Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Huawei Products: HarmonyOS, EMUI Problem Types: CWE-16 Description: Permission verification vulnerability in the wpa_supplicant module Impact: Successful exploitation of this vulnerability will affect availability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://consumer.huawei.com/en/support/bulletin/2024/5/ - https://device.harmonyos.com/cn/docs/security/update/security-bulletins-phones-202405-0000001902628049
CVE ID: CVE-2024-32992 State: PUBLISHED Published: 2024-05-11T09:49:03.841Z Last Updated: 2024-08-02T02:27:53.295Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Huawei Products: HarmonyOS, EMUI Problem Types: CWE-20 Description: Insufficient verification vulnerability in the baseband module Impact: Successful exploitation of this vulnerability will affect availability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://consumer.huawei.com/en/support/bulletin/2024/5/ - https://device.harmonyos.com/cn/docs/security/update/security-bulletins-phones-202405-0000001902628049
CVE ID: CVE-2024-32993 State: PUBLISHED Published: 2024-05-11T09:56:03.872Z Last Updated: 2024-08-02T02:27:53.477Z Severity: MEDIUM (CVSS 5.6 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:L) Vendors: Huawei Products: HarmonyOS, EMUI Problem Types: CWE-362 Description: Out-of-bounds access vulnerability in the memory module Impact: Successful exploitation of this vulnerability will affect availability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://consumer.huawei.com/en/support/bulletin/2024/5/ - https://device.harmonyos.com/cn/docs/security/update/security-bulletins-phones-202405-0000001902628049
CVE ID: CVE-2024-32995 State: PUBLISHED Published: 2024-05-11T10:00:18.321Z Last Updated: 2024-08-02T02:27:53.455Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Huawei Products: HarmonyOS, EMUI Problem Types: CWE-248 Description: Denial of service (DoS) vulnerability in the AMS module Impact: Successful exploitation of this vulnerability will affect availability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://consumer.huawei.com/en/support/bulletin/2024/5/ - https://device.harmonyos.com/cn/docs/security/update/security-bulletins-phones-202405-0000001902628049
CVE ID: CVE-2024-32996 State: PUBLISHED Published: 2024-05-11T10:02:22.311Z Last Updated: 2024-08-02T02:27:53.445Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Huawei Products: HarmonyOS, EMUI Problem Types: CWE-264 Description: Privilege escalation vulnerability in the account module Impact: Successful exploitation of this vulnerability will affect availability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://consumer.huawei.com/en/support/bulletin/2024/5/ - https://device.harmonyos.com/cn/docs/security/update/security-bulletins-phones-202405-0000001902628049
CVE ID: CVE-2024-32997 State: PUBLISHED Published: 2024-05-11T10:04:44.743Z Last Updated: 2024-08-02T02:27:53.286Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Huawei Products: HarmonyOS, EMUI Problem Types: CWE-362 Description: Race condition vulnerability in the binder driver module Impact: Successful exploitation of this vulnerability will affect availability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://consumer.huawei.com/en/support/bulletin/2024/5/ - https://device.harmonyos.com/cn/docs/security/update/security-bulletins-phones-202405-0000001902628049
CVE ID: CVE-2024-32998 State: PUBLISHED Published: 2024-05-11T10:08:09.604Z Last Updated: 2024-08-02T02:27:53.331Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: Huawei Products: HarmonyOS, EMUI Problem Types: CWE-824 Description: NULL pointer access vulnerability in the clock module Impact: Successful exploitation of this vulnerability will affect availability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://consumer.huawei.com/en/support/bulletin/2024/5/ - https://device.harmonyos.com/cn/docs/security/update/security-bulletins-phones-202405-0000001902628049
CVE ID: CVE-2024-32999 State: PUBLISHED Published: 2024-05-11T10:12:07.046Z Last Updated: 2024-08-02T02:27:53.478Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L) Vendors: Huawei Products: HarmonyOS, EMUI Problem Types: CWE-840 Description: Cracking vulnerability in the OS security module Impact: Successful exploitation of this vulnerability will affect availability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://consumer.huawei.com/en/support/bulletin/2024/5/ - https://device.harmonyos.com/cn/docs/security/update/security-bulletins-phones-202405-0000001902628049
CVE ID: CVE-2024-33000 State: PUBLISHED Published: 2024-05-14T03:46:59.914Z Last Updated: 2024-08-02T02:27:53.212Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N) Vendors: SAP_SE Products: SAP Bank Account Management Problem Types: CWE-862 Description: SAP Bank Account Management does not perform necessary authorization check for an authorized user, resulting in escalation of privileges. As a result, it has a low impact to confidentiality to the system. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://me.sap.com/notes/3392049 - https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html
CVE ID: CVE-2024-33001 State: PUBLISHED Published: 2024-06-11T02:05:00.333Z Last Updated: 2024-08-02T02:27:53.403Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: SAP_SE Products: SAP NetWeaver and ABAP platform Problem Types: CWE-400 Description: SAP NetWeaver and ABAP platform allows an attacker to impede performance for legitimate users by crashing or flooding the service. An impact of this Denial of Service vulnerability might be long response delays and service interruptions, thus degrading the service quality experienced by legitimate users causing high impact on availability of the application. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE
users causing high impact on availability of the application. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://me.sap.com/notes/3453170 - https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html
CVE ID: CVE-2024-33002 State: PUBLISHED Published: 2024-05-14T03:49:25.148Z Last Updated: 2024-08-02T02:27:53.478Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: SAP_SE Products: SAP S/4HANA (Document Service Handler for DPS) Problem Types: CWE-79 Description: Document Service handler (obsolete) in Data Provisioning Service does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability with low impact on Confidentiality and Integrity of the application. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://me.sap.com/notes/3460772 - https://support.sap.com/en/my-support/
chment: - CVE Program Container: References: - https://me.sap.com/notes/3460772 - https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html
CVE ID: CVE-2024-33003 State: PUBLISHED Published: 2024-08-13T03:36:55.034Z Last Updated: 2024-08-13T14:57:53.908Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: SAP_SE Products: SAP Commerce Cloud Problem Types: CWE-200 Description: Some OCC API endpoints in SAP Commerce Cloud allows Personally Identifiable Information (PII) data, such as passwords, email addresses, mobile numbers, coupon codes, and voucher codes, to be included in the request URL as query or path parameters. On successful exploitation, this could lead to a High impact on confidentiality and integrity of the application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https:
onfidentiality and integrity of the application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3459935 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2024-33004 State: PUBLISHED Published: 2024-05-14T04:00:25.081Z Last Updated: 2024-09-28T22:29:25.011Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: SAP_SE Products: SAP BusinessObjects Business Intelligence Platform (Webservices) Problem Types: CWE-524 Description: SAP Business Objects Business Intelligence Platform is vulnerable to Insecure Storage as dynamic web pages are getting cached even after logging out. On successful exploitation, the attacker can see the sensitive information through cache and can open the pages causing limited impact on Confidentiality, Integrity and Availability of the application. Additional Analyst Notes: - CISA
sing limited impact on Confidentiality, Integrity and Availability of the application. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://me.sap.com/notes/3449093 - https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html
CVE ID: CVE-2024-33005 State: PUBLISHED Published: 2024-08-13T03:47:44.829Z Last Updated: 2024-08-13T13:29:16.927Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H) Vendors: SAP_SE Products: SAP NetWeaver Application Server (ABAP and Java),SAP Web Dispatcher and SAP Content Server Problem Types: CWE-862 Description: Due to the missing authorization checks in the local systems, the admin users of SAP Web Dispatcher, SAP NetWeaver Application Server (ABAP and Java), and SAP Content Server can impersonate other users and may perform some unintended actions. This could lead to a low impact on confidentiality and a high impact on the integrity and availability of the applic
ns. This could lead to a low impact on confidentiality and a high impact on the integrity and availability of the applications. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3438085 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2024-33006 State: PUBLISHED Published: 2024-05-14T04:16:06.647Z Last Updated: 2024-08-02T02:27:53.232Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: SAP_SE Products: SAP NetWeaver Application Server ABAP and ABAP Platform Problem Types: CWE-434 Description: An unauthenticated attacker can upload a malicious file to the server which when accessed by a victim can allow an attacker to completely compromise system. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://me.sap.com/notes/3448171 - https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html
CVE ID: CVE-2024-33007 State: PUBLISHED Published: 2024-05-14T03:44:05.434Z Last Updated: 2024-10-30T18:34:02.458Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: SAP_SE Products: SAPUI5 (PDFViewer) Description: PDFViewer is a control delivered as part of SAPUI5 product which shows the PDF content in an embedded mode by default. If a PDF document contains embedded JavaScript (or any harmful client-side script), the PDFViewer will execute the JavaScript embedded in the PDF which can cause a potential security threat. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.sap.com/en/my-support/knowledge-base/secu
CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html - https://me.sap.com/notes/3446076