Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
me password reset functionalities being enabled. It also requires the system using php 7, which is not an officially supported version. Versions 7.14.4 and 8.6.1 contain a fix for this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/salesagility/SuiteCRM/security/advisories/GHSA-6p2f-wwx9-952r
CVE ID: CVE-2024-36408 State: PUBLISHED Published: 2024-06-10T16:46:00.935Z Last Updated: 2024-08-02T03:37:05.149Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H) Vendors: salesagility Products: SuiteCRM Problem Types: CWE-89 Description: SuiteCRM is an open-source Customer Relationship Management (CRM) software application. In versions prior to 7.14.4 and 8.6.1, poor input validation allows for SQL Injection in the `Alerts` controller. Versions 7.14.4 and 8.6.1 contain a fix for this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/salesagility/SuiteCRM/security/advisories/GHSA-2g8f-gjrr-x5cg
CVE ID: CVE-2024-36409 State: PUBLISHED Published: 2024-06-10T17:21:27.796Z Last Updated: 2024-08-02T03:37:05.248Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H) Vendors: salesagility Products: SuiteCRM Problem Types: CWE-89 Description: SuiteCRM is an open-source Customer Relationship Management (CRM) software application. In versions prior to 7.14.4 and 8.6.1, poor input validation allows for SQL Injection in Tree data entry point. Versions 7.14.4 and 8.6.1 contain a fix for this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/salesagility/SuiteCRM/security/advisories/GHSA-pxq4-vw23-v73f
CVE ID: CVE-2024-36410 State: PUBLISHED Published: 2024-06-10T17:24:08.514Z Last Updated: 2024-08-02T03:37:04.984Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H) Vendors: salesagility Products: SuiteCRM Problem Types: CWE-89 Description: SuiteCRM is an open-source Customer Relationship Management (CRM) software application. In versions prior to 7.14.4 and 8.6.1, poor input validation allows for SQL Injection in EmailUIAjax messages count controller. Versions 7.14.4 and 8.6.1 contain a fix for this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/salesagility/SuiteCRM/security/advisories/GHSA-7jj8-m
ichment: - CVE Program Container: References: - https://github.com/salesagility/SuiteCRM/security/advisories/GHSA-7jj8-m2wj-m6xq
CVE ID: CVE-2024-36411 State: PUBLISHED Published: 2024-06-10T19:33:49.887Z Last Updated: 2024-08-02T03:37:05.211Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H) Vendors: salesagility Products: SuiteCRM Problem Types: CWE-89 Description: SuiteCRM is an open-source Customer Relationship Management (CRM) software application. In versions prior to 7.14.4 and 8.6.1, poor input validation allows for SQL Injection in EmailUIAjax displayView controller. Versions 7.14.4 and 8.6.1 contain a fix for this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/salesagility/SuiteCRM/security/advisories/GHSA-9rvr-mcrf
ment: - CVE Program Container: References: - https://github.com/salesagility/SuiteCRM/security/advisories/GHSA-9rvr-mcrf-p4p7
CVE ID: CVE-2024-36412 State: PUBLISHED Published: 2024-06-10T19:35:43.980Z Last Updated: 2024-08-02T03:37:05.215Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: salesagility Products: SuiteCRM Problem Types: CWE-89 Description: SuiteCRM is an open-source Customer Relationship Management (CRM) software application. Prior to versions 7.14.4 and 8.6.1, a vulnerability in events response entry point allows for a SQL injection attack. Versions 7.14.4 and 8.6.1 contain a fix for this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/salesagility/SuiteCRM/security/advisories/GHSA-xjx2-38hv-5hh8
CVE ID: CVE-2024-36413 State: PUBLISHED Published: 2024-06-10T19:38:55.356Z Last Updated: 2024-08-02T03:37:05.279Z Severity: HIGH (CVSS 8.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L) Vendors: salesagility Products: SuiteCRM Problem Types: CWE-79 Description: SuiteCRM is an open-source Customer Relationship Management (CRM) software application. Prior to versions 7.14.4 and 8.6.1, a vulnerability in the import module error view allows for a cross-site scripting attack. Versions 7.14.4 and 8.6.1 contain a fix for this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/salesagility/SuiteCRM/security/advisories/GHSA-ph2c-hvvf-r2
t: - CVE Program Container: References: - https://github.com/salesagility/SuiteCRM/security/advisories/GHSA-ph2c-hvvf-r273
CVE ID: CVE-2024-36414 State: PUBLISHED Published: 2024-06-10T19:40:19.111Z Last Updated: 2024-08-02T03:37:05.207Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: salesagility Products: SuiteCRM Problem Types: CWE-918 Description: SuiteCRM is an open-source Customer Relationship Management (CRM) software application. Prior to versions 7.14.4 and 8.6.1, a vulnerability in the connectors file verification allows for a server-side request forgery attack. Versions 7.14.4 and 8.6.1 contain a fix for this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/salesagility/SuiteCRM/security/advisories/GHSA-
Vulnrichment: - CVE Program Container: References: - https://github.com/salesagility/SuiteCRM/security/advisories/GHSA-wg74-772c-8gr7
CVE ID: CVE-2024-36415 State: PUBLISHED Published: 2024-06-10T19:49:54.382Z Last Updated: 2024-08-02T03:37:05.143Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: salesagility Products: SuiteCRM Problem Types: CWE-98, CWE-434 Description: SuiteCRM is an open-source Customer Relationship Management (CRM) software application. Prior to versions 7.14.4 and 8.6.1, a vulnerability in uploaded file verification in products allows for remote code execution. Versions 7.14.4 and 8.6.1 contain a fix for this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/salesagility/SuiteCRM/security/advisories/GH
ADP Vulnrichment: - CVE Program Container: References: - https://github.com/salesagility/SuiteCRM/security/advisories/GHSA-c82f-58jv-jfrh
CVE ID: CVE-2024-36416 State: PUBLISHED Published: 2024-06-10T20:03:05.369Z Last Updated: 2025-02-13T17:52:54.171Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) Vendors: salesagility Products: SuiteCRM Problem Types: CWE-779 Description: SuiteCRM is an open-source Customer Relationship Management (CRM) software application. Prior to versions 7.14.4 and 8.6.1, a deprecated v4 API example with no log rotation allows denial of service by logging excessive data. Versions 7.14.4 and 8.6.1 contain a fix for this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/salesagility/SuiteCRM/security/advisories/GHSA-
Vulnrichment: - CVE Program Container: References: - https://github.com/salesagility/SuiteCRM/security/advisories/GHSA-jrpp-22g3-2j77 - https://docs.suitecrm.com/admin/releases/7.14.x/ - https://github.com/kva55/CVE-2024-36416
CVE ID: CVE-2024-36417 State: PUBLISHED Published: 2024-06-10T19:55:56.571Z Last Updated: 2024-08-02T03:37:05.099Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N) Vendors: salesagility Products: SuiteCRM Problem Types: CWE-79 Description: SuiteCRM is an open-source Customer Relationship Management (CRM) software application. Prior to versions 7.14.4 and 8.6.1, an unverified IFrame can be added some some inputs, which could allow for a cross-site scripting attack. Versions 7.14.4 and 8.6.1 contain a fix for this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/salesagility/SuiteCRM/security/advisories/
A ADP Vulnrichment: - CVE Program Container: References: - https://github.com/salesagility/SuiteCRM/security/advisories/GHSA-3www-6rqc-rm7j
CVE ID: CVE-2024-36418 State: PUBLISHED Published: 2024-06-10T20:16:47.940Z Last Updated: 2024-08-02T03:37:05.252Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: salesagility Products: SuiteCRM Problem Types: CWE-22 Description: SuiteCRM is an open-source Customer Relationship Management (CRM) software application. Prior to versions 7.14.4 and 8.6.1, a vulnerability in connectors allows an authenticated user to perform a remote code execution attack. Versions 7.14.4 and 8.6.1 contain a fix for this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/salesagility/SuiteCRM/security/advisories/GHSA-
Vulnrichment: - CVE Program Container: References: - https://github.com/salesagility/SuiteCRM/security/advisories/GHSA-mfj5-37v4-vh5w
CVE ID: CVE-2024-36419 State: PUBLISHED Published: 2024-06-10T21:15:37.840Z Last Updated: 2024-08-02T03:37:05.044Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: salesagility Products: SuiteCRM-Core Problem Types: CWE-601 Description: SuiteCRM is an open-source Customer Relationship Management (CRM) software application. A vulnerability in versions prior to 8.6.1 allows for Host Header Injection when directly accessing the `/legacy` route. Version 8.6.1 contains a patch for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/salesagility/SuiteCRM-Core/security/advisories/GHSA-3323-hjq3-c6vc
CVE ID: CVE-2024-36420 State: PUBLISHED Published: 2024-07-01T15:53:14.900Z Last Updated: 2024-08-02T03:37:05.346Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: FlowiseAI Products: Flowise Problem Types: CWE-74 Description: Flowise is a drag & drop user interface to build a customized large language model flow. In version 1.4.3 of Flowise, the `/api/v1/openai-assistants-file` endpoint in `index.ts` is vulnerable to arbitrary file read due to lack of sanitization of the `fileName` body parameter. No known patches for this issue are available. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://securitylab.github.c
. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://securitylab.github.com/advisories/GHSL-2023-232_GHSL-2023-234_Flowise/ - https://github.com/FlowiseAI/Flowise/blob/e93ce07851cdc0fcde12374f301b8070f2043687/packages/server/src/index.ts#L982
CVE ID: CVE-2024-36421 State: PUBLISHED Published: 2024-07-01T15:58:02.796Z Last Updated: 2024-08-02T03:37:05.196Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: FlowiseAI Products: Flowise Problem Types: CWE-346 Description: Flowise is a drag & drop user interface to build a customized large language model flow. In version 1.4.3 of Flowise, A CORS misconfiguration sets the Access-Control-Allow-Origin header to all, allowing arbitrary origins to connect to the website. In the default configuration (unauthenticated), arbitrary origins may be able to make requests to Flowise, stealing information from the user. This CORS misconfiguration may be chained with the
able to make requests to Flowise, stealing information from the user. This CORS misconfiguration may be chained with the path injection to allow an attacker attackers without access to Flowise to read arbitrary files from the Flowise server. As of time of publication, no known patches are available. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://securitylab.github.com/advisories/GHSL-2023-232_GHSL-2023-234_Flowise/ - https://github.com/FlowiseAI/Flowise/blob/e93ce07851cdc0fcde12374f301b8070f2043687/packages/server/src/index.ts#L122
CVE ID: CVE-2024-36422 State: PUBLISHED Published: 2024-07-01T16:02:31.600Z Last Updated: 2024-08-02T03:37:05.170Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: FlowiseAI Products: Flowise Problem Types: CWE-79 Description: Flowise is a drag & drop user interface to build a customized large language model flow. In version 1.4.3 of Flowise, a reflected cross-site scripting vulnerability occurs in the `api/v1/chatflows/id` endpoint. If the default configuration is used (unauthenticated), an attacker may be able to craft a specially crafted URL that injects Javascript into the user sessions, allowing the attacker to steal information, create false popups, or
URL that injects Javascript into the user sessions, allowing the attacker to steal information, create false popups, or even redirect the user to other websites without interaction. If the chatflow ID is not found, its value is reflected in the 404 page, which has type text/html. This allows an attacker to attach arbitrary scripts to the page, allowing an attacker to steal sensitive information. This XSS may be chained with the path injection to allow an attacker without direct access to Flowise to read arbitrary files from the Flowise server. As of time of publication, no known patches are available. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - h
known patches are available. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://securitylab.github.com/advisories/GHSL-2023-232_GHSL-2023-234_Flowise/ - https://github.com/FlowiseAI/Flowise/blob/flowise-ui%401.4.0/packages/server/src/index.ts#L312-L312
CVE ID: CVE-2024-36423 State: PUBLISHED Published: 2024-07-01T18:17:18.155Z Last Updated: 2024-08-02T03:37:04.950Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: FlowiseAI Products: Flowise Problem Types: CWE-79 Description: Flowise is a drag & drop user interface to build a customized large language model flow. In version 1.4.3 of Flowise, a reflected cross-site scripting vulnerability occurs in the `/api/v1/public-chatflows/id` endpoint. If the default configuration is used (unauthenticated), an attacker may be able to craft a specially crafted URL that injects Javascript into the user sessions, allowing the attacker to steal information, create false pop
crafted URL that injects Javascript into the user sessions, allowing the attacker to steal information, create false popups, or even redirect the user to other websites without interaction. If the chatflow ID is not found, its value is reflected in the 404 page, which has type text/html. This allows an attacker to attach arbitrary scripts to the page, allowing an attacker to steal sensitive information. This XSS may be chained with the path injection to allow an attacker without direct access to Flowise to read arbitrary files from the Flowise server. As of time of publication, no known patches are available. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: Referen
ion, no known patches are available. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://securitylab.github.com/advisories/GHSL-2023-232_GHSL-2023-234_Flowise/ - https://github.com/FlowiseAI/Flowise/blob/flowise-ui%401.4.0/packages/server/src/index.ts#L322-L322
CVE ID: CVE-2024-36424 State: PUBLISHED Published: 2024-08-06T00:00:00.000Z Last Updated: 2025-03-13T19:32:44.701Z Vendors: n/a Products: n/a Problem Types: n/a Description: K7RKScan.sys in K7 Ultimate Security before 17.0.2019 allows local users to cause a denial of service (BSOD) because of a NULL pointer dereference. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.k7computing.com/ - https://support.k7computing.com/index.php?/selfhelp/view-article/Advisory-issued-on-5th-aug-2024-417
CVE ID: CVE-2024-36426 State: PUBLISHED Published: 2024-05-27T00:00:00.000Z Last Updated: 2025-03-18T17:54:51.682Z Vendors: n/a Products: n/a Problem Types: n/a Description: In TARGIT Decision Suite 23.2.15007.0 before Autumn 2023, the session token is part of the URL and may be sent in a cleartext HTTP session. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://community.targit.com/hc/en-us/articles/12618082416028-Change-Log-On-prem - https://github.com/DMCERTCE/DecisionSuite_Token_in_Url - https://community.targit.com/hc/en-us/articles/16112758176156-Vulnerabilities
CVE ID: CVE-2024-36427 State: PUBLISHED Published: 2024-05-29T00:00:00 Last Updated: 2024-09-27T14:47:46.059611 Vendors: n/a Products: n/a Problem Types: n/a Description: The file-serving function in TARGIT Decision Suite before 24.06.19002 (TARGIT Decision Suite 2024 – June) allows authenticated attackers to read or write to server files via a crafted file request. This can allow code execution via a .xview file. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/DMCERTCE/DecisionSuite_Path_Traversal_SSRF - https://community.targit.com/hc/en-us/articles/16112758176156-Vulnerabilities
CVE ID: CVE-2024-36428 State: PUBLISHED Published: 2024-05-27T22:48:18.459Z Last Updated: 2025-02-13T15:59:20.450Z Vendors: n/a Products: n/a Problem Types: n/a Description: OrangeHRM 3.3.3 allows admin/viewProjects sortOrder SQL injection. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/4rdr/proofs/blob/main/info/OrangeHRM_3.3.3_SQLi_via_sortOrder.md - https://sourceforge.net/projects/orangehrm/files/stable/3.3.3/
CVE ID: CVE-2024-36432 State: PUBLISHED Published: 2024-07-15T00:00:00 Last Updated: 2024-08-02T03:37:05.147Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AC:H/AV:L/A:H/C:H/I:H/PR:H/S:C/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An arbitrary memory write vulnerability was discovered in Supermicro X11DPG-HGX2, X11PDG-QT, X11PDG-OT, and X11PDG-SN motherboards with BIOS firmware before 4.4. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.supermicro.com/en/support/security_center#%21advisories - https://www.supermicro.com/zh_tw/support/security_BIOS_Jul_2024
CVE ID: CVE-2024-36433 State: PUBLISHED Published: 2024-07-15T00:00:00 Last Updated: 2024-08-02T03:37:05.236Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AC:H/AV:L/A:H/C:H/I:H/PR:H/S:C/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An arbitrary memory write vulnerability was discovered in Supermicro X11DPH-T, X11DPH-Tq, and X11DPH-i motherboards with BIOS firmware before 4.4. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.supermicro.com/en/support/security_center#%21advisories - https://www.supermicro.com/en/support/security_BIOS_Jul_2024
CVE ID: CVE-2024-36434 State: PUBLISHED Published: 2024-07-15T00:00:00 Last Updated: 2024-08-02T03:37:05.237Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AC:H/AV:L/A:H/C:H/I:H/PR:H/S:C/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An SMM callout vulnerability was discovered in Supermicro X11DPH-T, X11DPH-Tq, and X11DPH-i motherboards with BIOS firmware before 4.4. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.supermicro.com/en/support/security_center#%21advisories - https://www.supermicro.com/en/support/security_BIOS_Jul_2024
CVE ID: CVE-2024-36435 State: PUBLISHED Published: 2024-07-11T00:00:00 Last Updated: 2024-08-02T03:37:05.220Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Supermicro BMC firmware in select X11, X12, H12, B12, X13, H13, and B13 motherboards (and CMM6 modules). An unauthenticated user can post crafted data to the interface that triggers a stack buffer overflow, and may lead to arbitrary remote code execution on a BMC. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.supermicro.com/zh_tw/support/security_BMC_IPMI_Jul_2024
CVE ID: CVE-2024-36437 State: PUBLISHED Published: 2025-02-03T00:00:00.000Z Last Updated: 2025-02-05T16:35:17.654Z Vendors: n/a Products: n/a Problem Types: n/a Description: The com.enflick.android.TextNow (aka TextNow: Call + Text Unlimited) application 24.17.0.2 for Android enables any installed application (with no permissions) to place phone calls without user interaction by sending a crafted intent via the com.enflick.android.TextNow.activities.DialerActivity component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://play.google.com/store/apps/details?id=com.enflick.android.TextNow - https://github.com/actuator/com.enflick.android.TextNow/blob/main/CVE-2024-3643
details?id=com.enflick.android.TextNow - https://github.com/actuator/com.enflick.android.TextNow/blob/main/CVE-2024-36437
CVE ID: CVE-2024-36438 State: PUBLISHED Published: 2024-07-15T00:00:00 Last Updated: 2024-08-02T03:37:05.209Z Vendors: n/a Products: n/a Problem Types: n/a Description: eLinkSmart Hidden Smart Cabinet Lock 2024-05-22 has Incorrect Access Control and fails to perform an authorization check which can lead to card duplication and other attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.syss.de/pentest-blog/ - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-044.txt
CVE ID: CVE-2024-36439 State: PUBLISHED Published: 2024-08-22T00:00:00 Last Updated: 2024-08-28T00:09:14.315Z Vendors: n/a Products: n/a Problem Types: n/a Description: Swissphone DiCal-RED 4009 devices allow a remote attacker to gain access to the administrative web interface via the device password's hash value, without knowing the actual device password. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.swissphone.com/en-us/solutions/components/terminals/radio-data-module-dical-red/ - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-038.txt
CVE ID: CVE-2024-36440 State: PUBLISHED Published: 2024-08-22T00:00:00 Last Updated: 2024-08-22T23:03:09.482Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Swissphone DiCal-RED 4009 devices. An attacker with access to the file /etc/deviceconfig may recover the administrative device password via password-cracking methods, because unsalted MD5 is used. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.swissphone.com/en-us/solutions/components/terminals/radio-data-module-dical-red/ - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-037.txt
CVE ID: CVE-2024-36441 State: PUBLISHED Published: 2024-08-22T00:00:00 Last Updated: 2024-08-23T00:09:12.571Z Vendors: n/a Products: n/a Problem Types: n/a Description: Swissphone DiCal-RED 4009 devices allow an unauthenticated attacker use a port-2101 TCP connection to gain access to operation messages that are received by the device. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.swissphone.com/en-us/solutions/components/terminals/radio-data-module-dical-red/ - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-042.txt
CVE ID: CVE-2024-36442 State: PUBLISHED Published: 2024-08-22T00:00:00 Last Updated: 2024-08-23T13:48:21.135Z Vendors: n/a Products: n/a Problem Types: n/a Description: cgi-bin/fdmcgiwebv2.cgi on Swissphone DiCal-RED 4009 devices allows an authenticated attacker to gain access to arbitrary files on the device's file system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.swissphone.com/en-us/solutions/components/terminals/radio-data-module-dical-red/ - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-039.txt