Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-47901 State: PUBLISHED Published: 2024-10-23T14:21:19.200Z Last Updated: 2024-10-23T18:18:54.551Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Siemens Products: InterMesh 7177 Hybrid 2.0 Subscriber, InterMesh 7707 Fire Subscriber Problem Types: CWE-78 Description: A vulnerability has been identified in InterMesh 7177 Hybrid 2.0 Subscriber (All versions < V8.2.12), InterMesh 7707 Fire Subscriber (All versions < V7.2.12 only if the IP interface is enabled (which is not the default configuration)). The web server of affected devices does not sanitize the input parameters in specific GET requests that allow for code execution on operating sy
ed devices does not sanitize the input parameters in specific GET requests that allow for code execution on operating system level. In combination with other vulnerabilities (CVE-2024-47902, CVE-2024-47903, CVE-2024-47904) this could allow an unauthenticated remote attacker to execute arbitrary code with root privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-333468.html
CVE ID: CVE-2024-47902 State: PUBLISHED Published: 2024-10-23T14:21:20.501Z Last Updated: 2024-10-23T18:16:39.383Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: Siemens Products: InterMesh 7177 Hybrid 2.0 Subscriber, InterMesh 7707 Fire Subscriber Problem Types: CWE-306 Description: A vulnerability has been identified in InterMesh 7177 Hybrid 2.0 Subscriber (All versions < V8.2.12), InterMesh 7707 Fire Subscriber (All versions < V7.2.12 only if the IP interface is enabled (which is not the default configuration)). The web server of affected devices does not authenticate GET requests that execute specific commands (such as `ping`) on operating system level. A
devices does not authenticate GET requests that execute specific commands (such as `ping`) on operating system level. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-333468.html
CVE ID: CVE-2024-47903 State: PUBLISHED Published: 2024-10-23T14:21:21.774Z Last Updated: 2024-10-23T18:02:13.310Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N) Vendors: Siemens Products: InterMesh 7177 Hybrid 2.0 Subscriber, InterMesh 7707 Fire Subscriber Problem Types: CWE-250 Description: A vulnerability has been identified in InterMesh 7177 Hybrid 2.0 Subscriber (All versions < V8.2.12), InterMesh 7707 Fire Subscriber (All versions < V7.2.12 only if the IP interface is enabled (which is not the default configuration)). The web server of affected devices allows to write arbitrary files to the web server's DocumentRoot directory. Additional Analyst Notes: - CISA
ed devices allows to write arbitrary files to the web server's DocumentRoot directory. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-333468.html
CVE ID: CVE-2024-47904 State: PUBLISHED Published: 2024-10-23T14:21:23.086Z Last Updated: 2024-10-23T18:00:15.305Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Siemens Products: InterMesh 7177 Hybrid 2.0 Subscriber, InterMesh 7707 Fire Subscriber Problem Types: CWE-266 Description: A vulnerability has been identified in InterMesh 7177 Hybrid 2.0 Subscriber (All versions < V8.2.12), InterMesh 7707 Fire Subscriber (All versions < V7.2.12 only if the IP interface is enabled (which is not the default configuration)). The affected devices contain a SUID binary that could allow an authenticated local attacker to execute arbitrary commands with root privileges. Ad
in a SUID binary that could allow an authenticated local attacker to execute arbitrary commands with root privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-333468.html
CVE ID: CVE-2024-47905 State: PUBLISHED Published: 2024-11-12T15:56:13.827Z Last Updated: 2024-11-12T18:35:42.210Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: Ivanti Products: Connect Secure, Policy Secure Problem Types: CWE-121 Description: A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.3 and Ivanti Policy Secure before version 22.7R1.2 allows a remote authenticated attacker with admin privileges to cause a denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-ICS-Ivanti-Policy-Secure-IPS-Ivanti-Secure-Access-Client-ISA
vanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-ICS-Ivanti-Policy-Secure-IPS-Ivanti-Secure-Access-Client-ISAC-Multiple-CVEs
CVE ID: CVE-2024-47906 State: PUBLISHED Published: 2024-11-12T15:59:53.269Z Last Updated: 2024-11-22T16:31:00.963Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Ivanti Products: Connect Secure, Policy Secure Problem Types: CWE-267, CWE-426 Description: Excessive binary privileges in Ivanti Connect Secure before version 22.7R2.3 (Not Applicable to 9.1Rx) and Ivanti Policy Secure before version 22.7R1.2 (Not Applicable to 9.1Rx) allows a local authenticated attacker to escalate privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-ICS-Ivanti-Policy-Secure-IPS-Iva
ferences: - https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-ICS-Ivanti-Policy-Secure-IPS-Ivanti-Secure-Access-Client-ISAC-Multiple-CVEs
CVE ID: CVE-2024-47907 State: PUBLISHED Published: 2024-11-12T16:00:49.792Z Last Updated: 2024-11-12T20:02:31.143Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Ivanti Products: Connect Secure Problem Types: CWE-121 Description: A stack-based buffer overflow in IPsec of Ivanti Connect Secure before version 22.7R2.3 allows a remote unauthenticated attacker to cause a denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-ICS-Ivanti-Policy-Secure-IPS-Ivanti-Secure-Access-Client-ISAC-Multiple-CVEs
CVE ID: CVE-2024-47908 State: PUBLISHED Published: 2025-02-11T15:18:49.425Z Last Updated: 2025-02-13T04:55:12.278Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Ivanti Products: Cloud Services Application Problem Types: CWE-78 Description: OS command injection in the admin web console of Ivanti CSA before version 5.0.5 allows a remote authenticated attacker with admin privileges to achieve remote code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Cloud-Services-Application-CSA-CVE-2024-47908-CVE-2024-11771
CVE ID: CVE-2024-47909 State: PUBLISHED Published: 2024-11-12T16:02:28.451Z Last Updated: 2024-11-19T17:10:28.514Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: Ivanti Products: Connect Secure, Policy Secure Problem Types: CWE-121 Description: A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.3 and Ivanti Policy Secure before version 22.7R1.2 allows a remote authenticated attacker with admin privileges to cause a denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-ICS-Ivanti-Policy-Secure-IPS-Ivanti-Secure-Access-Client-ISA
CVE ID: CVE-2024-47910 State: PUBLISHED Published: 2024-10-04T00:00:00 Last Updated: 2024-10-04T22:16:52.055Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in SonarSource SonarQube before 9.9.5 LTA and 10.x before 10.5. A SonarQube user with the Administrator role can modify an existing configuration of a GitHub integration to exfiltrate a pre-signed JWT. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://sonarsource.atlassian.net/browse/SONAR-21795 - https://sonarsource.atlassian.net/browse/SONAR-21813 - https://community.sonarsource.com/t/sonarqube-github-integration-information-leakage/126609
CVE ID: CVE-2024-47911 State: PUBLISHED Published: 2024-10-04T00:00:00 Last Updated: 2024-10-04T22:16:42.218Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AC:L/AV:N/A:L/C:H/I:H/PR:H/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: In SonarSource SonarQube 10.4 through 10.5 before 10.6, a vulnerability was discovered in the authorizations/group-memberships API endpoint that allows SonarQube users with the administrator role to inject blind SQL commands. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://sonarsource.atlassian.net/browse/SONAR-22340
CVE ID: CVE-2024-47912 State: PUBLISHED Published: 2024-10-21T00:00:00 Last Updated: 2024-10-22T17:32:44.732Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability in the AWV (Audio, Web, and Video) Conferencing component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated attacker to perform unauthorized data-access attacks due to missing authentication mechanisms. A successful exploit could allow an attacker to access and delete sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-misa-2024-0027
CVE ID: CVE-2024-47913 State: PUBLISHED Published: 2024-10-04T00:00:00 Last Updated: 2024-12-06T21:07:18.749Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the AbuseFilter extension for MediaWiki before 1.39.9, 1.40.x and 1.41.x before 1.41.3, and 1.42.x before 1.42.2. An API caller can match a filter condition against AbuseFilter logs even if the caller is not authorized to view the log details for the filter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://phabricator.wikimedia.org/T372998 - https://gerrit.wikimedia.org/r/c/mediawiki/extensions/AbuseFilter/+/1076855
CVE ID: CVE-2024-47914 State: PUBLISHED Published: 2024-11-14T09:56:03.283Z Last Updated: 2024-11-14T19:35:09.723Z Severity: MEDIUM (CVSS 4.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N) Vendors: VaeMendis Products: VaeMendis Ubooquity version 2.1.2 Problem Types: CWE-352 Description: VaeMendis - CWE-352: Cross-Site Request Forgery (CSRF) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.gov.il/en/Departments/faq/cve_advisories
CVE ID: CVE-2024-47915 State: PUBLISHED Published: 2024-11-14T09:57:25.797Z Last Updated: 2024-11-14T19:34:50.687Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: VaeMendis Products: VaeMendis Ubooquity version 2.1.2 Problem Types: CWE-200 Description: VaeMendis - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.gov.il/en/Departments/faq/cve_advisories
CVE ID: CVE-2024-47916 State: PUBLISHED Published: 2024-11-14T10:00:23.334Z Last Updated: 2024-11-14T19:34:34.938Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Boa web server Products: Boa web server 0.94.14rc21 Problem Types: CWE-22 Description: Boa web server - CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.gov.il/en/Departments/faq/cve_advisories
CVE ID: CVE-2024-47917 State: PUBLISHED Published: 2024-12-30T09:40:10.453Z Last Updated: 2024-12-30T16:20:48.446Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Mobotix Products: CCTV FW Problem Types: CWE-79 Description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.gov.il/en/Departments/faq/cve_advisories
CVE ID: CVE-2024-47918 State: PUBLISHED Published: 2024-12-30T09:41:53.284Z Last Updated: 2024-12-30T16:16:34.788Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Tiki Wiki Products: CMS Problem Types: CWE-78 Description: Tiki Wiki CMS – CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.gov.il/en/Departments/faq/cve_advisories
CVE ID: CVE-2024-47919 State: PUBLISHED Published: 2024-12-30T09:43:39.028Z Last Updated: 2024-12-30T16:14:07.584Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Tiki Wiki Products: CMS Problem Types: CWE-78 Description: Tiki Wiki CMS – CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.gov.il/en/Departments/faq/cve_advisories
CVE ID: CVE-2024-47920 State: PUBLISHED Published: 2024-12-30T09:46:10.708Z Last Updated: 2024-12-30T14:21:38.132Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Tiki Wiki Products: CMS Problem Types: CWE-79 Description: Tiki Wiki CMS – CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.gov.il/en/Departments/faq/cve_advisories
CVE ID: CVE-2024-47921 State: PUBLISHED Published: 2024-12-30T09:47:38.715Z Last Updated: 2024-12-30T14:21:13.348Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Smadar Products: SPS Problem Types: CWE-327 Description: Smadar SPS – CWE-327: Use of a Broken or Risky Cryptographic Algorithm Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.gov.il/en/Departments/faq/cve_advisories
CVE ID: CVE-2024-47922 State: PUBLISHED Published: 2024-12-30T09:50:53.564Z Last Updated: 2024-12-30T14:20:52.699Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Priority Products: PRI WEB Problem Types: CWE-200 Description: Priority – CWE-200: Exposure of Sensitive Information to an Unauthorized Actor Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.gov.il/en/Departments/faq/cve_advisories
CVE ID: CVE-2024-47923 State: PUBLISHED Published: 2024-12-30T09:52:06.419Z Last Updated: 2024-12-30T14:20:09.267Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Mashov Products: Mashov Problem Types: CWE-200 Description: Mashov – CWE-200: Exposure of Sensitive Information to an Unauthorized Actor Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.gov.il/en/Departments/faq/cve_advisories
CVE ID: CVE-2024-47924 State: PUBLISHED Published: 2024-12-30T10:04:03.164Z Last Updated: 2024-12-30T14:19:47.386Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Boa web Products: Boa web Problem Types: CWE-79 Description: Boa web server – CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.gov.il/en/Departments/faq/cve_advisories
CVE ID: CVE-2024-47925 State: PUBLISHED Published: 2024-12-30T10:05:37.933Z Last Updated: 2024-12-30T14:19:05.295Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Tecnick Products: TCExam Problem Types: CWE-79 Description: Tecnick TCExam – Multiple CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.gov.il/en/Departments/faq/cve_advisories
CVE ID: CVE-2024-47926 State: PUBLISHED Published: 2024-12-30T10:06:57.531Z Last Updated: 2024-12-30T14:15:40.179Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Tecnick Products: TCExam Problem Types: CWE-89 Description: Tecnick TCExam – CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.gov.il/en/Departments/faq/cve_advisories
CVE ID: CVE-2024-47934 State: PUBLISHED Published: 2025-01-08T03:00:31.170Z Last Updated: 2025-01-08T14:47:49.865Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: TXOne Networks Products: Portable Inspector, Portable Inspector Pro Edition Problem Types: CWE-20 Description: Improper Input Validation vulnerability in Management Program in TXOne Networks Portable Inspector and Portable Inspector Pro Edition allows remote attacker to crash management service. The Denial of Service situation can be resolved by restarting the management service. This issue affects Portable Inspector: through 1.0.0; Portable Inspector Pro Edition: through 1.0.0. Additional Analyst
This issue affects Portable Inspector: through 1.0.0; Portable Inspector Pro Edition: through 1.0.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.txone.com/psirt/advisories/cve-2024-47934/
CVE ID: CVE-2024-47935 State: PUBLISHED Published: 2025-02-17T06:11:47.235Z Last Updated: 2025-02-18T19:32:26.121Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: TXOne Networks Products: StellarProtect (Legacy Mode), StellarEnforce, Safe Lock Problem Types: CWE-354 Description: Improper Validation of Integrity Check Value vulnerability in TXOne Networks StellarProtect (Legacy Mode), StellarEnforce, and Safe Lock allows an attacker to escalate their privileges in the victim’s device. The attacker needs to hijack the DLL file in advance. This issue affects StellarProtect (Legacy Mode): before 3.2; StellarEnforce: before 3.2; Safe Lock: from 3.0.0 before 3.1.1
s issue affects StellarProtect (Legacy Mode): before 3.2; StellarEnforce: before 3.2; Safe Lock: from 3.0.0 before 3.1.1076. *Note: StellarProtect (Legacy Mode) is the new name for StellarEnforce, they are the same product. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.txone.com/psirt/advisories/cve-2024-47935/
CVE ID: CVE-2024-47939 State: PUBLISHED Published: 2024-11-01T04:29:04.040Z Last Updated: 2025-05-21T07:02:10.101Z Severity: HIGH (CVSS 7.7 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L) Vendors: Ricoh Company, Ltd., KONICA MINOLTA, INC. Products: Multiple laser printers and MFPs which implement Web Image Monitor, Multiple MFPs which implement Web Image Monitor Problem Types: CWE-121 Description: Stack-based buffer overflow vulnerability exists in multiple laser printers and MFPs which implement Ricoh Web Image Monitor. If this vulnerability is exploited, receiving a specially crafted request created and sent by an attacker may lead to arbitrary code execution and/or a denial-of-service (DoS)
ly crafted request created and sent by an attacker may lead to arbitrary code execution and/or a denial-of-service (DoS) condition. As for the details of affected product names and versions, refer to the information provided by the vendors under [References]. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ricoh.com/products/security/vulnerabilities/vul?id=ricoh-2024-000011 - https://jp.ricoh.com/security/products/vulnerabilities/vul?id=ricoh-2024-000011 - https://www.konicaminolta.jp/business/support/important/250519_01_01.html - https://jvn.jp/en/jp/JVN87770340/
CVE ID: CVE-2024-47940 State: PUBLISHED Published: 2024-11-12T12:49:49.740Z Last Updated: 2024-11-12T16:14:49.716Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Siemens Products: Solid Edge SE2024 Problem Types: CWE-125 Description: A vulnerability has been identified in Solid Edge SE2024 (All versions < V224.0 Update 9). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted PSM files. This could allow an attacker to execute code in the context of the current process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-35
Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-351178.html
CVE ID: CVE-2024-47941 State: PUBLISHED Published: 2024-11-12T12:49:50.990Z Last Updated: 2024-11-12T16:12:38.815Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Siemens Products: Solid Edge SE2024 Problem Types: CWE-125 Description: A vulnerability has been identified in Solid Edge SE2024 (All versions < V224.0 Update 9). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-35
CVE ID: CVE-2024-47942 State: PUBLISHED Published: 2024-11-12T12:49:52.230Z Last Updated: 2024-11-12T16:10:47.014Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Siemens Products: Solid Edge SE2024 Problem Types: CWE-427 Description: A vulnerability has been identified in Solid Edge SE2024 (All versions < V224.0 Update 9). The affected applications suffer from a DLL hijacking vulnerability. This could allow an attacker to execute arbitrary code via placing a crafted DLL file on the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-351178.html
CVE ID: CVE-2024-47943 State: PUBLISHED Published: 2024-10-15T08:57:05.068Z Last Updated: 2025-11-03T22:21:53.100Z Vendors: RITTAL GmbH & Co. KG Products: IoT Interface & CMC III Processing Unit Problem Types: CWE-347 Description: The firmware upgrade function in the admin web interface of the Rittal IoT Interface & CMC III Processing Unit devices checks if the patch files are signed before executing the containing run.sh script. The signing process is kind of an HMAC with a long string as key which is hard-coded in the firmware and is freely available for download. This allows crafting malicious "signed" .patch files in order to compromise the device and execute arbitrary code. Additional A
lows crafting malicious "signed" .patch files in order to compromise the device and execute arbitrary code. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://r.sec-consult.com/rittaliot - https://www.rittal.com/de-de/products/deep/3124300
CVE ID: CVE-2024-47944 State: PUBLISHED Published: 2024-10-15T09:00:30.605Z Last Updated: 2025-11-03T22:21:54.572Z Vendors: RITTAL GmbH & Co. KG Products: IoT Interface & CMC III Processing Unit Problem Types: CWE-1299 Description: The device directly executes .patch firmware upgrade files on a USB stick without any prior authentication in the admin interface. This leads to an unauthenticated code execution via the firmware upgrade function. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://r.sec-consult.com/rittaliot - https://www.rittal.com/de-de/products/deep/3124300
CVE ID: CVE-2024-47945 State: PUBLISHED Published: 2024-10-15T10:05:58.333Z Last Updated: 2025-11-03T22:21:56.044Z Vendors: RITTAL GmbH & Co. KG Products: IoT Interface & CMC III Processing Unit Problem Types: CWE-340 Description: The devices are vulnerable to session hijacking due to insufficient entropy in its session ID generation algorithm. The session IDs are predictable, with only 32,768 possible values per user, which allows attackers to pre-generate valid session IDs, leading to unauthorized access to user sessions. This is not only due to the use of an (insecure) rand() function call but also because of missing initialization via srand(). As a result only the PIDs are effectively us
and() function call but also because of missing initialization via srand(). As a result only the PIDs are effectively used as seed. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://r.sec-consult.com/rittaliot - https://www.rittal.com/de-de/products/deep/3124300