Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-47186 State: PUBLISHED Published: 2024-09-27T21:04:33.587Z Last Updated: 2024-09-27T21:56:30.280Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: filamentphp Products: filament Problem Types: CWE-79 Description: Filament is a collection of full-stack components for Laravel development. Versions of Filament from v3.0.0 through v3.2.114 are affected by a cross-site scripting (XSS) vulnerability. If values passed to a `ColorColumn` or `ColumnEntry` are not valid and contain a specific set of characters, applications are vulnerable to XSS attack against a user who opens a page on which a color column or entry is rendered. Filament v3.2.115 fixes
able to XSS attack against a user who opens a page on which a color column or entry is rendered. Filament v3.2.115 fixes this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/filamentphp/filament/security/advisories/GHSA-9h9q-qhxg-89xr - https://github.com/filamentphp/filament/commit/df7989352464d08eda5837ef50f9997fad902316 - https://github.com/filamentphp/filament/releases/tag/v3.2.115
CVE ID: CVE-2024-47187 State: PUBLISHED Published: 2024-10-16T18:50:53.726Z Last Updated: 2024-10-16T19:40:34.303Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: OISF Products: suricata Problem Types: CWE-330 Description: Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to version 7.0.7, missing initialization of the random seed for "thash" leads to datasets having predictable hash table behavior. This can lead to dataset file loading to use excessive time to load, as well as runtime performance issues during traffic handling. This issue has been addressed in 7.0.7. As a workaround, av
well as runtime performance issues during traffic handling. This issue has been addressed in 7.0.7. As a workaround, avoid loading datasets from untrusted sources. Avoid dataset rules that track traffic in rules. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/OISF/suricata/security/advisories/GHSA-64ww-4f6x-863p - https://redmine.openinfosecfoundation.org/issues/7209
CVE ID: CVE-2024-47188 State: PUBLISHED Published: 2024-10-16T18:58:11.542Z Last Updated: 2024-10-16T19:38:54.398Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: OISF Products: suricata Problem Types: CWE-330 Description: Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to version 7.0.7, missing initialization of the random seed for "thash" leads to byte-range tracking having predictable hash table behavior. This can lead to an attacker forcing lots of data into a single hash bucket, leading to severe performance degradation. This issue has been addressed in 7.0.7. Additional Analyst N
gle hash bucket, leading to severe performance degradation. This issue has been addressed in 7.0.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/OISF/suricata/security/advisories/GHSA-qq5v-qcjx-f872 - https://redmine.openinfosecfoundation.org/issues/7289
CVE ID: CVE-2024-47189 State: PUBLISHED Published: 2024-10-21T00:00:00 Last Updated: 2024-11-04T21:50:17.150Z Vendors: n/a Products: n/a Problem Types: n/a Description: The API Interface of the AWV (Audio, Web and Video Conferencing) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated attacker to conduct SQL injection due to insufficient sanitization of user input. A successful exploit could allow an attacker with knowledge of specific details to access non-sensitive user provisioning information and execute arbitrary SQL database commands. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.mitel.com/support/security-advisories
ands. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-misa-2024-0026
CVE ID: CVE-2024-47190 State: PUBLISHED Published: 2024-11-08T00:00:00 Last Updated: 2024-11-08T18:17:17.371Z Vendors: n/a Products: n/a Problem Types: n/a Description: Northern.tech Hosted Mender before 2024.07.11 allows SSRF. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mender.io/blog/cve-2024-46947-cve-2024-47190-ssrf-issues-in-mender-enterprise-server
CVE ID: CVE-2024-47191 State: PUBLISHED Published: 2024-10-09T00:00:00 Last Updated: 2024-10-18T03:08:08.622Z Vendors: n/a Products: n/a Problem Types: n/a Description: pam_oath.so in oath-toolkit 2.6.7 through 2.6.11 before 2.6.12 allows root privilege escalation because, in the context of PAM code running as root, it mishandles usersfile access, such as by calling fchown in the presence of a symlink. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/oath-toolkit/oath-toolkit/-/issues/43 - https://www.openwall.com/lists/oss-security/2024/10/04/2 - https://security.opensuse.org/2024/10/04/oath-toolkit-vulnerability.html - https://www
lists/oss-security/2024/10/04/2 - https://security.opensuse.org/2024/10/04/oath-toolkit-vulnerability.html - https://www.nongnu.org/oath-toolkit/security/CVE-2024-47191 - https://gitlab.com/oath-toolkit/oath-toolkit/-/commit/60d9902b5c20f27e70f8e9c816bfdc0467567e1a - https://gitlab.com/oath-toolkit/oath-toolkit/-/commit/3235a52f6b87cd1c5da6508f421ac261f5e33a70 - https://gitlab.com/oath-toolkit/oath-toolkit/-/commit/3271139989fde35ab0163b558fc29e80c3a280e5 - https://gitlab.com/oath-toolkit/oath-toolkit/-/commit/95ef255e6a401949ce3f67609bf8aac2029db418
CVE ID: CVE-2024-47192 State: PUBLISHED Published: 2025-08-26T00:00:00.000Z Last Updated: 2025-08-27T16:22:16.133Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Mahara 23.04.8 and 24.04.4. The use of a malicious export download URL can allow an attacker to download files that they do not have permission to download. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mahara.org/interaction/forum/view.php?id=43 - https://mahara.org/interaction/forum/topic.php?id=9594
CVE ID: CVE-2024-47193 State: PUBLISHED Published: 2024-11-29T00:00:00 Last Updated: 2024-11-29T17:15:47.870Z Vendors: n/a Products: n/a Problem Types: n/a Description: WithSecure Elements Agent for Mac before 24.3, MDR before 24.3, and Elements Client Security for Mac before 16.10 allow a remote Denial of Service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.withsecure.com/en/support/security-advisories/cve-2024-47193
CVE ID: CVE-2024-47194 State: PUBLISHED Published: 2024-10-08T08:40:46.551Z Last Updated: 2024-10-08T17:12:45.619Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Siemens Products: ModelSim, Questa Problem Types: CWE-427 Description: A vulnerability has been identified in ModelSim (All versions < V2024.3), Questa (All versions < V2024.3). vish2.exe in affected applications allows a specific DLL file to be loaded from the current working directory. This could allow an authenticated local attacker to inject arbitrary code and escalate privileges in installations where administrators or processes with elevated privileges launch vish2.exe from a user-writable di
ges in installations where administrators or processes with elevated privileges launch vish2.exe from a user-writable directory. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-426509.html
CVE ID: CVE-2024-47195 State: PUBLISHED Published: 2024-10-08T08:40:47.801Z Last Updated: 2024-10-08T16:51:24.486Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Siemens Products: ModelSim, Questa Problem Types: CWE-427 Description: A vulnerability has been identified in ModelSim (All versions < V2024.3), Questa (All versions < V2024.3). gdb.exe in affected applications allows a specific executable file to be loaded from the current working directory. This could allow an authenticated local attacker to inject arbitrary code and escalate privileges in installations where administrators or processes with elevated privileges launch gdb.exe from a user-writable
ivileges in installations where administrators or processes with elevated privileges launch gdb.exe from a user-writable directory. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-426509.html
CVE ID: CVE-2024-47196 State: PUBLISHED Published: 2024-10-08T08:40:49.065Z Last Updated: 2025-06-17T08:11:22.933Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Siemens Products: ModelSim, Questa Problem Types: CWE-427 Description: A vulnerability has been identified in ModelSim (All versions < V2025.2), Questa (All versions < V2025.2). vsimk.exe in affected applications allows a specific tcl file to be loaded from the current working directory. This could allow an authenticated local attacker to inject arbitrary code and escalate privileges in installations where administrators or processes with elevated privileges launch vsimk.exe from a user-writable di
ges in installations where administrators or processes with elevated privileges launch vsimk.exe from a user-writable directory. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-426509.html
CVE ID: CVE-2024-47197 State: PUBLISHED Published: 2024-09-26T08:01:24.486Z Last Updated: 2025-03-17T17:36:10.410Z Vendors: Apache Software Foundation Products: Maven Archetype Plugin Problem Types: CWE-200, CWE-922 Description: Exposure of Sensitive Information to an Unauthorized Actor, Insecure Storage of Sensitive Information vulnerability in Maven Archetype Plugin. This issue affects Maven Archetype Plugin: from 3.2.1 before 3.3.0. Users are recommended to upgrade to version 3.3.0, which fixes the issue. Archetype integration testing creates a file called ./target/classes/archetype-it/archetype-settings.xml This file contains all the content from the users ~/.m2/settings.xml file, which
es/archetype-it/archetype-settings.xml This file contains all the content from the users ~/.m2/settings.xml file, which often contains information they do not want to publish. We expect that on many developer machines, this also contains credentials. When the user runs mvn verify again (without a mvn clean), this file becomes part of the final artifact. If a developer were to publish this into Maven Central or any other remote repository (whether as a release or a snapshot) their credentials would be published without them knowing. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/ftg81np183wnyk0kg4ks95dvgxdrof96
CVE ID: CVE-2024-47208 State: PUBLISHED Published: 2024-11-18T08:43:17.743Z Last Updated: 2024-11-19T14:59:02.765Z Vendors: Apache Software Foundation Products: Apache OFBiz Problem Types: CWE-918, CWE-94 Description: Server-Side Request Forgery (SSRF), Improper Control of Generation of Code ('Code Injection') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.17. Users are recommended to upgrade to version 18.12.17, which fixes the issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://ofbiz.apache.org/download.html - https://ofbiz.apache.org/security.html - https://issues.apache.org/jira/browse/OFBIZ-13158 - https:
.org/download.html - https://ofbiz.apache.org/security.html - https://issues.apache.org/jira/browse/OFBIZ-13158 - https://lists.apache.org/thread/022r19skfofhv3lzql33vowlrvqndh11
CVE ID: CVE-2024-47210 State: PUBLISHED Published: 2024-09-21T00:00:00 Last Updated: 2024-09-23T15:26:54.395Z Vendors: n/a Products: n/a Problem Types: n/a Description: Gladys Assistant before 4.45.1 allows Privilege Escalation (a user changing their own role) because req.body.role can be used in updateMySelf in server/api/controllers/user.controller.js. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/GladysAssistant/Gladys/compare/v4.45.0...v4.45.1 - https://github.com/GladysAssistant/Gladys/pull/2115 - https://github.com/GladysAssistant/Gladys/commit/344ad9b8ca3078d9292dd95f2dd7b9172bc6ebbe
CVE ID: CVE-2024-47211 State: PUBLISHED Published: 2024-10-04T00:00:00 Last Updated: 2024-11-05T15:06:00.808Z Vendors: n/a Products: n/a Problem Types: n/a Description: In OpenStack Ironic before 21.4.4, 22.x and 23.x before 23.0.3, 23.x and 24.x before 24.1.3, and 25.x and 26.x before 26.1.0, there is a lack of checksum validation of supplied image_source URLs when configured to convert images to a raw format for streaming. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/openstack/ironic/tags - https://github.com/openstack/ironic/compare/24.1.2...26.1.0 - https://github.com/openstack/ironic/security - https://security.openstack.or
/openstack/ironic/compare/24.1.2...26.1.0 - https://github.com/openstack/ironic/security - https://security.openstack.org/ossa/OSSA-2024-004.html
CVE ID: CVE-2024-47212 State: PUBLISHED Published: 2025-04-03T00:00:00.000Z Last Updated: 2025-04-04T15:15:29.113Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Iglu Server 0.13.0 and below. It involves sending very large payloads to a particular API endpoint of Iglu Server and can render it completely unresponsive. If the operation of Iglu Server is not restored, event processing in the pipeline would eventually halt. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.snowplow.io/hc/en-us/articles/26318139354909-Update-Critical-Snowplow-Security-Updates-Impact-on-Open-Source-Software-Users
CVE ID: CVE-2024-47213 State: PUBLISHED Published: 2025-04-03T00:00:00.000Z Last Updated: 2025-04-04T13:37:37.043Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered affecting Enrich 5.1.0 and below. It involves sending a maliciously crafted Snowplow event to the pipeline. Upon receiving this event and trying to validate it, Enrich crashes and attempts to restart indefinitely. As a result, event processing would be halted. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.snowplow.io/hc/en-us/articles/26318139354909-Update-Critical-Snowplow-Security-Updates-Impact-on-Open-Source-Software-Users
CVE ID: CVE-2024-47214 State: PUBLISHED Published: 2025-04-03T00:00:00.000Z Last Updated: 2025-04-07T18:39:59.184Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Iglu Server 0.13.0 and below. It is similar to CVE-2024-47212, but involves a different kind of malicious payload. As above, it can render Iglu Server completely unresponsive. If the operation of Iglu Server is not restored, event processing in the pipeline would eventually halt. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.snowplow.io/hc/en-us/articles/26318139354909-Update-Critical-Snowplow-Security-Updates-Impact-on-Open-Source-Software-Users
CVE ID: CVE-2024-47215 State: PUBLISHED Published: 2025-04-03T00:00:00.000Z Last Updated: 2025-04-07T18:43:56.871Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Snowbridge setups sending data to Google Tag Manager Server Side. It involves attaching an invalid GTM SS preview header to events, causing them to be retried indefinitely. As a result, the performance of forwarding events to GTM SS overall can be affected (latency, throughput). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.snowplow.io/hc/en-us/articles/26318139354909-Update-Critical-Snowplow-Security-Updates-Impact-on-Open-Source-Software-Users
CVE ID: CVE-2024-47217 State: PUBLISHED Published: 2025-04-03T00:00:00.000Z Last Updated: 2025-04-07T18:50:19.237Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Iglu Server 0.13.0 and below. It is similar to CVE-2024-47214, but involves an authenticated endpoint. It can render Iglu Server completely unresponsive. If the operation of Iglu Server is not restored, event processing in the pipeline would eventually halt. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.snowplow.io/hc/en-us/articles/26318139354909-Update-Critical-Snowplow-Security-Updates-Impact-on-Open-Source-Software-Users
CVE ID: CVE-2024-47218 State: PUBLISHED Published: 2024-09-22T00:00:00 Last Updated: 2024-09-23T15:14:41.256Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in vesoft NebulaGraph through 3.8.0. It allows bypassing authentication. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/vesoft-inc/nebula/pull/5936 - https://github.com/vesoft-inc/nebula/pull/5936/commits/cd6c5976ccfe817b2e0a2d46227cd361bfefb45c
CVE ID: CVE-2024-47219 State: PUBLISHED Published: 2024-09-21T00:00:00.000Z Last Updated: 2025-03-14T17:00:25.054Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in vesoft NebulaGraph through 3.8.0. It allows shell command injection. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/vesoft-inc/nebula/pull/5936 - https://github.com/vesoft-inc/nebula/pull/5936/commits/cd6c5976ccfe817b2e0a2d46227cd361bfefb45c
CVE ID: CVE-2024-47220 State: PUBLISHED Published: 2024-09-22T00:00:00 Last Updated: 2025-01-09T17:33:17.696Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the WEBrick toolkit through 1.8.1 for Ruby. It allows HTTP request smuggling by providing both a Content-Length header and a Transfer-Encoding header, e.g., "GET /admin HTTP/1.1\r\n" inside of a "POST /user HTTP/1.1\r\n" request. NOTE: the supplier's position is "Webrick should not be used in production." Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ruby/webrick/issues/145 - https://github.com/ruby/webrick/pull/146/commits/d88321da45dcd230ac2b4585cad4833d6d5e88
ub.com/ruby/webrick/issues/145 - https://github.com/ruby/webrick/pull/146/commits/d88321da45dcd230ac2b4585cad4833d6d5e8841 - https://github.com/ruby/webrick/issues/145#issuecomment-2369994610 - https://github.com/ruby/webrick/issues/145#issuecomment-2372838285
CVE ID: CVE-2024-47221 State: PUBLISHED Published: 2024-09-22T00:00:00.000Z Last Updated: 2025-03-19T15:49:57.660Z Vendors: n/a Products: n/a Problem Types: n/a Description: CheckUser in ScadaServerEngine/MainLogic.cs in Rapid SCADA through 5.8.4 allows an empty password. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/RapidScada/scada/commit/b14cbdfa6cf3a205e57f2383c915365adc3859a7
CVE ID: CVE-2024-47222 State: PUBLISHED Published: 2024-09-23T00:00:00.000Z Last Updated: 2025-03-18T20:42:56.224Z Vendors: n/a Products: n/a Problem Types: n/a Description: New Cloud MyOffice SDK Collaborative Editing Server 2.2.2 through 2.8 allows SSRF via manipulation of requests from external document storage via the MS-WOPI protocol. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://myoffice.ru/ - https://support.myoffice.ru/products/myoffice-sdk/
CVE ID: CVE-2024-47223 State: PUBLISHED Published: 2024-10-21T00:00:00 Last Updated: 2024-10-22T17:22:08.377Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability in the AWV (Audio, Web and Video Conferencing) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated attacker to conduct a SQL injection attack due to insufficient sanitization of user input. A successful exploit could allow an attacker to access non-sensitive user provisioning information and execute arbitrary SQL database commands. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.mitel.com/support/security-advisories/mitel-product-security-advi
es: - CISA ADP Vulnrichment: References: - https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-misa-2024-0028
CVE ID: CVE-2024-47224 State: PUBLISHED Published: 2024-10-21T00:00:00 Last Updated: 2024-11-05T21:05:47.109Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability in the AWV (Audio, Web and Video Conferencing) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated attacker to conduct a CRLF injection attack due to inadequate encoding of user input in URLs. A successful exploit could allow an attacker to perform a phishing attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-misa-2024-0025
CVE ID: CVE-2024-47226 State: PUBLISHED Published: 2024-09-22T00:00:00.000Z Last Updated: 2025-02-11T21:43:56.176Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability exists in NetBox 4.1.0 within the "Configuration History" feature of the "Admin" panel via a /core/config-revisions/ Add action. An authenticated user can inject arbitrary JavaScript or HTML into the "Top banner" field. NOTE: Multiple third parties have disputed this as not a vulnerability. It is argued that the configuration revision banner feature is meant to contain unsanitized HTML in order to display notifications to users. Since these fields are intended to display
eant to contain unsanitized HTML in order to display notifications to users. Since these fields are intended to display unsanitized HTML, this is working as intended. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/tu3n4nh/netbox/issues/1 - https://github.com/netbox-community/netbox/releases/tag/v4.1.0
CVE ID: CVE-2024-47227 State: PUBLISHED Published: 2024-09-23T00:00:00.000Z Last Updated: 2025-03-25T14:11:38.770Z Vendors: n/a Products: n/a Problem Types: n/a Description: iRedAdmin before 2.6 allows XSS, e.g., via order_name. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/iredmail/iRedAdmin/commit/b537e71ecf522d7f10180f5f0aab4a98a881893a - https://www.iredmail.org - https://github.com/iredmail/iRedAdmin/commit/3c72b438d412ea3ee0270f6956e19b1098c19191 - https://github.com/iredmail/iRedAdmin/compare/2.5...2.6 - https://docs.iredmail.org/upgrade.iredmail.1.6.8-1.7.0.html#upgrade-iredadmin-open-source-edition-to-the-latest-stable-release-26
CVE ID: CVE-2024-47238 State: PUBLISHED Published: 2024-12-12T17:38:19.407Z Last Updated: 2024-12-12T19:00:54.508Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Dell Products: Dell Client Platform BIOS Problem Types: CWE-20 Description: Dell Client Platform BIOS contains an Improper Input Validation vulnerability in an externally developed component. A high privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000227595/dsa-2024-355
CVE ID: CVE-2024-47239 State: PUBLISHED Published: 2025-01-08T02:00:15.883Z Last Updated: 2025-01-08T15:33:59.525Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Dell Products: PowerScale OneFS Problem Types: CWE-400 Description: Dell PowerScale OneFS versions 8.2.2.x through 9.9.0.0 contain an uncontrolled resource consumption vulnerability. A remote low privileged attacker could potentially exploit this vulnerability, leading to denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000269590/dsa-2024-480-security-update-for-dell-powerscale-onefs-security-vulnerability