Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-27093 State: PUBLISHED Published: 2024-02-26T21:57:25.101Z Last Updated: 2024-08-27T19:43:28.099Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L) Vendors: stacklok Products: minder Problem Types: CWE-20 Description: Minder is a Software Supply Chain Security Platform. In version 0.0.31 and earlier, it is possible for an attacker to register a repository with a invalid or differing upstream ID, which causes Minder to report the repository as registered, but not remediate any future changes which conflict with policy (because the webhooks for the repo do not match any known repository in the database). When attempting to register a repo with a differen
ooks for the repo do not match any known repository in the database). When attempting to register a repo with a different repo ID, the registered provider must have admin on the named repo, or a 404 error will result. Similarly, if the stored provider token does not have repo access, then the remediations will not apply successfully. Lastly, it appears that reconciliation actions do not execute against repos with this type of mismatch. This appears to primarily be a potential denial-of-service vulnerability. This vulnerability is patched in version 0.20240226.1425+ref.53868a8. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/stacklo
a8. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/stacklok/minder/security/advisories/GHSA-q6h8-4j2v-pjg4 - https://github.com/stacklok/minder/commit/53868a878e93f29c43437f96dbc990b548e48d1d
CVE ID: CVE-2024-27094 State: PUBLISHED Published: 2024-02-29T18:18:24.721Z Last Updated: 2024-08-02T19:35:12.184Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H) Vendors: OpenZeppelin Products: openzeppelin-contracts Problem Types: CWE-125 Description: OpenZeppelin Contracts is a library for secure smart contract development. The `Base64.encode` function encodes a `bytes` input by iterating over it in chunks of 3 bytes. When this input is not a multiple of 3, the last iteration may read parts of the memory that are beyond the input buffer. The vulnerability is fixed in 5.0.2 and 4.9.6. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Refer
erability is fixed in 5.0.2 and 4.9.6. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-9vx6-7xxf-x967 - https://github.com/OpenZeppelin/openzeppelin-contracts-upgradeable/commit/2d081f24cac1a867f6f73d512f2022e1fa987854 - https://github.com/OpenZeppelin/openzeppelin-contracts-upgradeable/commit/723f8cab09cdae1aca9ec9cc1cfa040c2d4b06c1 - https://github.com/OpenZeppelin/openzeppelin-contracts/commit/92224533b1263772b0774eec3134e132a3d7b2a6 - https://github.com/OpenZeppelin/openzeppelin-contracts/commit/a6286d0fded8771b3a645e5813e51993c490399c
CVE ID: CVE-2024-27095 State: PUBLISHED Published: 2024-07-10T19:07:45.995Z Last Updated: 2024-08-02T00:27:59.577Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N) Vendors: decidim Products: decidim Problem Types: CWE-79 Description: Decidim is a participatory democracy framework. The admin panel is subject to potential XSS attach in case the attacker manages to modify some records being uploaded to the server. This vulnerability is fixed in 0.27.6 and 0.28.1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/decidim/decidim/security/advisories/GHSA-529p-jj47-w3m3 - https://github.com/decidim/decidim/releases/
ttps://github.com/decidim/decidim/security/advisories/GHSA-529p-jj47-w3m3 - https://github.com/decidim/decidim/releases/tag/v0.27.6 - https://github.com/decidim/decidim/releases/tag/v0.28.1
CVE ID: CVE-2024-27096 State: PUBLISHED Published: 2024-03-18T16:11:08.100Z Last Updated: 2025-04-10T20:23:57.596Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: glpi-project Products: glpi Problem Types: CWE-89 Description: GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An authenticated user can exploit a SQL injection vulnerability in the search engine to extract data from the database. This issue has been patched in version 10.0.13. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/glpi-project/glpi/securi
alyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/glpi-project/glpi/security/advisories/GHSA-2x8m-vrcm-2jqv - https://github.com/glpi-project/glpi/commit/61a0c2302b4f633f5065358adc36058e1abc37f9 - https://github.com/glpi-project/glpi/releases/tag/10.0.13
CVE ID: CVE-2024-27097 State: PUBLISHED Published: 2024-03-13T20:40:50.855Z Last Updated: 2024-08-21T15:05:52.767Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: ckan Products: ckan Problem Types: CWE-532 Description: A user endpoint didn't perform filtering on an incoming parameter, which was added directly to the application log. This could lead to an attacker injecting false log entries or corrupt the log file format. This has been fixed in the CKAN versions 2.9.11 and 2.10.4. Users are advised to upgrade. Users unable to upgrade should override the `/user/reset` endpoint to filter the `id` parameter in order to exclude newlines. Additional Analyst Notes
override the `/user/reset` endpoint to filter the `id` parameter in order to exclude newlines. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ckan/ckan/security/advisories/GHSA-8g38-3m6v-232j - https://github.com/ckan/ckan/commit/81b56c55e5e3651d7fcf9642cd5a489a9b62212c
CVE ID: CVE-2024-27098 State: PUBLISHED Published: 2024-03-18T16:14:18.894Z Last Updated: 2024-08-02T00:27:59.073Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: glpi-project Products: glpi Problem Types: CWE-918 Description: GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An authenticated user can execute a SSRF based attack using Arbitrary Object Instantiation. This issue has been patched in version 10.0.13. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/glpi-project/glpi/security/advisories/GHSA-92x4-q
ulnrichment: - CVE Program Container: References: - https://github.com/glpi-project/glpi/security/advisories/GHSA-92x4-q9w5-837w - https://github.com/glpi-project/glpi/commit/3b6bc1b4aa1f3693b20ada3425d2de5108522484 - https://github.com/glpi-project/glpi/releases/tag/10.0.13
CVE ID: CVE-2024-27099 State: PUBLISHED Published: 2024-02-27T18:58:26.274Z Last Updated: 2024-08-02T00:27:59.513Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Azure Products: azure-uamqp-c Problem Types: CWE-415 Description: The uAMQP is a C library for AMQP 1.0 communication to Azure Cloud Services. When processing an incorrect `AMQP_VALUE` failed state, may cause a double free problem. This may cause a RCE. Update submodule with commit 2ca42b6e4e098af2d17e487814a91d05f6ae4987. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/Azure/azure-uamqp-c/security/advisories/GHSA-6rh4-fj44-v4jj - https
Program Container: References: - https://github.com/Azure/azure-uamqp-c/security/advisories/GHSA-6rh4-fj44-v4jj - https://github.com/Azure/azure-uamqp-c/commit/2ca42b6e4e098af2d17e487814a91d05f6ae4987
CVE ID: CVE-2024-27100 State: PUBLISHED Published: 2024-03-15T19:21:49.443Z Last Updated: 2024-08-02T00:27:59.432Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: discourse Products: discourse Problem Types: CWE-400 Description: Discourse is an open source platform for community discussion. In affected versions the endpoints for suspending users, silencing users and exporting CSV files weren't enforcing limits on the sizes of the parameters that they accept. This could lead to excessive resource consumption which could render an instance inoperable. A site could be disrupted by either a malicious moderator on the same site or a malicious staff member on anot
operable. A site could be disrupted by either a malicious moderator on the same site or a malicious staff member on another site in the same multisite cluster. This issue is patched in the latest stable, beta and tests-passed versions of Discourse. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/discourse/discourse/security/advisories/GHSA-xq4v-qg27-gxgc - https://github.com/discourse/discourse/commit/8cade1e825e90a66f440e820992d43c6905f4b47
CVE ID: CVE-2024-27101 State: PUBLISHED Published: 2024-03-01T21:01:39.049Z Last Updated: 2025-04-16T20:46:45.603Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:N/I:H/A:H) Vendors: authzed Products: spicedb Problem Types: CWE-190 Description: SpiceDB is an open source, Google Zanzibar-inspired database for creating and managing security-critical application permissions. Integer overflow in chunking helper causes dispatching to miss elements or panic. Any SpiceDB cluster with any schema where a resource being checked has more than 65535 relationships for the same resource and subject type is affected by this problem. The CheckPermission, BulkCheckPermission, and LookupSubjects A
me resource and subject type is affected by this problem. The CheckPermission, BulkCheckPermission, and LookupSubjects API methods are affected. This vulnerability is fixed in 1.29.2. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/authzed/spicedb/security/advisories/GHSA-h3m7-rqc4-7h9p - https://github.com/authzed/spicedb/commit/ef443c442b96909694390324a99849b0407007fe
CVE ID: CVE-2024-27102 State: PUBLISHED Published: 2024-03-13T20:28:07.637Z Last Updated: 2025-04-15T15:18:00.430Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: pterodactyl Products: wings Problem Types: CWE-22, CWE-363, CWE-362 Description: Wings is the server control plane for Pterodactyl Panel. This vulnerability impacts anyone running the affected versions of Wings. The vulnerability can potentially be used to access files and directories on the host system. The full scope of impact is exactly unknown, but reading files outside of a server's base directory (sandbox root) is possible. In order to use this exploit, an attacker must have an existing "ser
server's base directory (sandbox root) is possible. In order to use this exploit, an attacker must have an existing "server" allocated and controlled by Wings. Details on the exploitation of this vulnerability are embargoed until March 27th, 2024 at 18:00 UTC. In order to mitigate this vulnerability, a full rewrite of the entire server filesystem was necessary. Because of this, the size of the patch is massive, however effort was made to reduce the amount of breaking changes. Users are advised to update to version 1.11.9. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/pterodac
y. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/pterodactyl/wings/security/advisories/GHSA-494h-9924-xww9 - https://github.com/pterodactyl/wings/commit/d1c0ca526007113a0f74f56eba99511b4e989287
CVE ID: CVE-2024-27103 State: PUBLISHED Published: 2024-02-28T17:41:36.012Z Last Updated: 2024-08-02T00:27:59.282Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: pinterest Products: querybook Problem Types: CWE-79 Description: Querybook is a Big Data Querying UI. When a user searches for their queries, datadocs, tables and lists, the search result is marked and highlighted, and this feature uses dangerouslySetInnerHTML which means that if the highlighted result has an XSS payload it will trigger. While the input to dangerouslySetInnerHTML is not sanitized for the data inside of queries which leads to an XSS vulnerability. During the "query auto-suggestion"
is not sanitized for the data inside of queries which leads to an XSS vulnerability. During the "query auto-suggestion" the name of the suggested tables are set with innerHTML which leads to the XSS vulnerability. A patch to rectify this issue has been introduced in Querybook version 3.31.2. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/pinterest/querybook/security/advisories/GHSA-3hjm-9277-5c88 - https://github.com/pinterest/querybook/commit/449bdc9e7d679e042c3718b7ed07d2ffa3c46a8f
CVE ID: CVE-2024-27104 State: PUBLISHED Published: 2024-03-18T16:16:38.709Z Last Updated: 2024-08-26T14:00:56.673Z Severity: MEDIUM (CVSS 4.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N) Vendors: glpi-project Products: glpi Problem Types: CWE-79 Description: GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. A user with rights to create and share dashboards can build a dashboard containing javascript code. Any user that will open this dashboard will be subject to an XSS attack. This issue has been patched in version 10.0.13. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Re
ssue has been patched in version 10.0.13. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/glpi-project/glpi/security/advisories/GHSA-prc3-cx5m-h5mj - https://github.com/glpi-project/glpi/commit/b409ca437864607b03c2014b9e3293b7f141af65 - https://github.com/glpi-project/glpi/releases/tag/10.0.13
CVE ID: CVE-2024-27105 State: PUBLISHED Published: 2024-03-20T18:11:58.069Z Last Updated: 2024-08-02T17:38:02.805Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: frappe Products: frappe Problem Types: CWE-863 Description: Frappe is a full-stack web application framework. Prior to versions 14.66.3 and 15.16.0, file permission can be bypassed using certain endpoints, granting less privileged users permission to delete or clone a file. Versions 14.66.3 and 15.16.0 contain a patch for this issue. No known workarounds are available. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/frappe/frappe/security/a
alyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/frappe/frappe/security/advisories/GHSA-hq5v-q29v-7rcw
CVE ID: CVE-2024-27106 State: PUBLISHED Published: 2024-05-14T17:01:22.488Z Last Updated: 2024-08-02T00:27:59.190Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: GE HealthCare Products: EchoPAC Software Only, ImageVault, EchoPAC Turnkey Problem Types: CWE-311 Description: Vulnerable data in transit in GE HealthCare EchoPAC products Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://securityupdate.gehealthcare.com/
CVE ID: CVE-2024-27107 State: PUBLISHED Published: 2024-05-14T17:05:22.568Z Last Updated: 2024-08-02T00:27:59.234Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: GE HealthCare Products: EchoPAC Software Only, ImageVault, EchoPAC Turnkey Problem Types: CWE-798 Description: Weak account password in GE HealthCare EchoPAC products Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://securityupdate.gehealthcare.com/
CVE ID: CVE-2024-27108 State: PUBLISHED Published: 2024-05-14T17:09:08.166Z Last Updated: 2024-08-02T00:27:58.693Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: GE HealthCare Products: EchoPAC Software Only, ImageVault, EchoPAC Turnkey Problem Types: CWE-732 Description: Non privileged access to critical file vulnerability in GE HealthCare EchoPAC products Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://securityupdate.gehealthcare.com/
CVE ID: CVE-2024-27109 State: PUBLISHED Published: 2024-05-14T17:13:16.193Z Last Updated: 2024-08-02T00:27:59.369Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: GE HealthCare Products: EchoPAC Software Only, ImageVault, EchoPAC Turnkey Problem Types: CWE-522 Description: Insufficiently protected credentials in GE HealthCare EchoPAC products Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://securityupdate.gehealthcare.com/
CVE ID: CVE-2024-27110 State: PUBLISHED Published: 2024-05-14T17:16:39.659Z Last Updated: 2024-08-02T00:27:59.489Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: GE HealthCare Products: EchoPAC Software Only, ImageVault, EchoPAC Turnkey Problem Types: CWE-250 Description: Elevation of privilege vulnerability in GE HealthCare EchoPAC products Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://securityupdate.gehealthcare.com/
CVE ID: CVE-2024-27112 State: PUBLISHED Published: 2024-09-11T13:41:16.813Z Last Updated: 2025-03-11T13:38:33.375Z Vendors: Simple Online Planning Products: SO Planning Problem Types: CWE-89 Description: A unauthenticated SQL Injection has been found in the SO Planning tool that occurs when the public view setting is enabled. An attacker could use this vulnerability to gain access to the underlying database. The vulnerability has been remediated in version 1.52.02. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://csirt.divd.nl/CVE-2024-27112
CVE ID: CVE-2024-27113 State: PUBLISHED Published: 2024-09-11T13:41:16.358Z Last Updated: 2025-03-11T13:38:34.743Z Vendors: Simple Online Planning Products: SO Planning Problem Types: CWE-200 Description: An unauthenticated Insecure Direct Object Reference (IDOR) to the database has been found in the SO Planning tool that occurs when the public view setting is enabled. An attacker could use this vulnerability to gain access to the underlying database by exporting it as a CSV file. The vulnerability has been remediated in version 1.52.02. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://csirt.divd.nl/CVE-2024-27113
CVE ID: CVE-2024-27114 State: PUBLISHED Published: 2024-09-11T13:41:16.662Z Last Updated: 2025-03-11T13:38:37.507Z Vendors: Simple Online Planning Products: SO Planning Problem Types: CWE-367 Description: A unauthenticated Remote Code Execution (RCE) vulnerability is found in the SO Planning online planning tool. If the public view setting is enabled, a attacker can upload a PHP-file that will be available for execution for a few milliseconds before it is removed, leading to execution of code on the underlying system. The vulnerability has been remediated in version 1.52.02. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://csirt.divd.nl/CVE-2024-27114
CVE ID: CVE-2024-27115 State: PUBLISHED Published: 2024-09-11T13:41:16.520Z Last Updated: 2025-03-11T13:38:36.122Z Vendors: Simple Online Planning Products: SO Planning Problem Types: CWE-434 Description: A unauthenticated Remote Code Execution (RCE) vulnerability is found in the SO Planning online planning tool. With this vulnerability, an attacker can upload executable files that are moved to a publicly accessible folder before verifying any requirements. This leads to the possibility of execution of code on the underlying system when the file is triggered. The vulnerability has been remediated in version 1.52.02. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://csi
ity has been remediated in version 1.52.02. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://csirt.divd.nl/CVE-2024-27115
CVE ID: CVE-2024-27120 State: PUBLISHED Published: 2024-08-14T19:56:50.598Z Last Updated: 2025-03-11T13:38:40.244Z Vendors: Celsius Benelux Products: ComfortKey Problem Types: CWE-200 Description: A Local File Inclusion vulnerability has been found in ComfortKey, a product of Celsius Benelux. Using this vulnerability, an unauthenticated attacker may retrieve sensitive information about the underlying system. The vulnerability has been remediated in version 24.1.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://csirt.divd.nl/CVE-2024-27120 - https://csirt.divd.nl/DIVD-2024-00031/
CVE ID: CVE-2024-27121 State: PUBLISHED Published: 2024-03-12T07:55:48.301Z Last Updated: 2024-08-16T19:50:12.016Z Vendors: OMRON Corporation Products: Machine Automation Controller NJ Series , Machine Automation Controller NX Series Problem Types: Path traversal Description: Path traversal vulnerability exists in Machine Automation Controller NJ Series and Machine Automation Controller NX Series. An arbitrary file in the affected product may be accessed or arbitrary code may be executed by processing a specially crafted request sent from a remote attacker with an administrative privilege. As for the details of the affected product names/versions, see the information provided by the vendor u
ative privilege. As for the details of the affected product names/versions, see the information provided by the vendor under [References] section. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.fa.omron.co.jp/product/security/assets/pdf/en/OMSR-2024-001_en.pdf - https://www.fa.omron.co.jp/product/security/assets/pdf/ja/OMSR-2024-001_ja.pdf - https://jvn.jp/en/vu/JVNVU95852116/index.html
CVE ID: CVE-2024-27122 State: PUBLISHED Published: 2024-09-06T16:26:32.362Z Last Updated: 2024-09-06T17:27:22.814Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N) Vendors: QNAP Systems Inc. Products: Notes Station 3 Problem Types: CWE-79 Description: A cross-site scripting (XSS) vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow authenticated users to inject malicious code via a network. We have already fixed the vulnerability in the following versions: Notes Station 3 3.9.6 and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security-advisory/qsa-24-21
CVE ID: CVE-2024-27124 State: PUBLISHED Published: 2024-04-26T15:00:55.893Z Last Updated: 2024-08-02T00:27:59.078Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: QNAP Systems Inc. Products: QTS, QuTS hero, QuTScloud Problem Types: CWE-78 Description: An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute commands via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.3.2578 build 20231110 and later QTS 4.5.4.2627 build 20231225 and later QuTS hero h5.1.3.2578 build 20231110 and later QuTS hero h4.5.4.2626 build 202
r QTS 4.5.4.2627 build 20231225 and later QuTS hero h5.1.3.2578 build 20231110 and later QuTS hero h4.5.4.2626 build 20231225 and later QuTScloud c5.1.5.2651 and later Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.qnap.com/en/security-advisory/qsa-24-09