Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-52921 State: PUBLISHED Published: 2024-11-18T00:00:00 Last Updated: 2024-11-18T15:35:17.211Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Bitcoin Core before 25.0, a peer can affect the download state of other peers by sending a mutated block. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures - https://bitcoincore.org/en/2024/10/08/disclose-mutated-blocks-hindering-propagation/
CVE ID: CVE-2024-52922 State: PUBLISHED Published: 2024-11-18T00:00:00 Last Updated: 2024-11-18T16:15:38.481Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Bitcoin Core before 25.1, an attacker can cause a node to not download the latest block, because there can be minutes of delay when an announcing peer stalls instead of complying with the peer-to-peer protocol specification. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures - https://bitcoincore.org/en/2024/11/05/cb-stall-hindering-propagation/
CVE ID: CVE-2024-52923 State: PUBLISHED Published: 2025-03-06T00:00:00.000Z Last Updated: 2025-03-07T19:52:09.972Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in NRMM in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 9820, 9825, 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 9110, W920, W930, W1000, Modem 5123, Modem 5300, and Modem 5400. Lack of a boundary check during the decoding of DL NAS Transport messages leads to a Denial of Service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://semiconductor.samsung.com/support/quality-support/product-security-updates/
CVE ID: CVE-2024-52924 State: PUBLISHED Published: 2025-03-06T00:00:00.000Z Last Updated: 2025-03-07T19:51:17.250Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in NRMM in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 9820, 9825, 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 9110, W920, W930, W1000, Modem 5123, Modem 5300, and Modem 5400. Lack of boundary check during the decoding of Registration Accept messages can lead to out-of-bounds writes on the stack Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://semiconductor.samsung.com/support/quality-support/product-security-updates/
CVE ID: CVE-2024-52925 State: PUBLISHED Published: 2025-02-26T00:00:00.000Z Last Updated: 2025-02-26T15:50:33.333Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: OPSWAT Products: MetaDefender Kiosk Problem Types: CWE-94 Description: In OPSWAT MetaDefender Kiosk before 4.7.0, arbitrary code execution can be performed by an attacker via the MD Kiosk Unlock Device feature for software encrypted USB drives. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.opswat.com/docs/mdkiosk/release-notes/cve-2024-52925
CVE ID: CVE-2024-52926 State: PUBLISHED Published: 2024-11-18T00:00:00 Last Updated: 2025-01-06T17:55:59.966Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H) Vendors: Delinea Products: Privilege Manager Problem Types: CWE-269 Description: Delinea Privilege Manager before 12.0.2 mishandles the security of the Windows agent. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.delinea.com/online-help/privilege-manager/release-notes/12.0.2-combined.htm - https://trust.delinea.com/?tcuUid=3be1a12c-97c9-431e-a51a-0c25da19ec86
CVE ID: CVE-2024-52928 State: PUBLISHED Published: 2025-06-26T00:00:00.000Z Last Updated: 2025-06-27T13:38:43.810Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AC:L/AV:N/A:L/C:H/I:H/PR:N/S:C/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: Arc before 1.26.1 on Windows has a bypass issue in the site settings that allows websites (with previously granted permissions) to add new permissions when the user clicks anywhere on the website. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://thebrowser.company - https://arc.net/security/bulletins#windows-site-settings-bypass-cve-2024-52928
CVE ID: CVE-2024-52935 State: PUBLISHED Published: 2025-01-13T10:33:56.052Z Last Updated: 2025-01-13T18:46:53.869Z Vendors: Imagination Technologies Products: Graphics DDK Problem Types: CWE-823 Description: Kernel software installed and running inside a Guest VM may exploit memory shared with the GPU Firmware to write data outside the Guest's virtualised GPU memory. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.imaginationtech.com/gpu-driver-vulnerabilities/
CVE ID: CVE-2024-52936 State: PUBLISHED Published: 2025-01-13T10:35:41.734Z Last Updated: 2025-01-31T16:16:26.762Z Vendors: Imagination Technologies Products: Graphics DDK Problem Types: CWE-823 Description: Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to write data outside the Guest's virtualised GPU memory. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.imaginationtech.com/gpu-driver-vulnerabilities/
CVE ID: CVE-2024-52937 State: PUBLISHED Published: 2025-01-13T10:37:03.187Z Last Updated: 2025-01-13T15:56:26.099Z Vendors: Imagination Technologies Products: Graphics DDK Problem Types: CWE-823 Description: Kernel software installed and running inside a Guest VM may exploit memory shared with the GPU Firmware to write data outside the Guest's virtualised GPU memory. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.imaginationtech.com/gpu-driver-vulnerabilities/
CVE ID: CVE-2024-52938 State: PUBLISHED Published: 2025-01-13T11:50:24.185Z Last Updated: 2025-01-13T14:54:41.464Z Vendors: Imagination Technologies Products: Graphics DDK Problem Types: CWE-823 Description: Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to subvert reconstruction activities to trigger a write of data outside the Guest's virtualised GPU memory. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.imaginationtech.com/gpu-driver-vulnerabilities/
CVE ID: CVE-2024-52939 State: PUBLISHED Published: 2025-02-22T14:54:56.218Z Last Updated: 2025-02-24T12:28:55.898Z Vendors: Imagination Technologies Products: Graphics DDK Problem Types: CWE-823 Description: Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a write data outside the Guest's virtualised GPU memory. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.imaginationtech.com/gpu-driver-vulnerabilities/
CVE ID: CVE-2024-52940 State: PUBLISHED Published: 2024-11-18T00:00:00 Last Updated: 2024-11-23T04:55:41.101Z Vendors: n/a Products: n/a Problem Types: n/a Description: AnyDesk through 8.1.0 on Windows, when Allow Direct Connections is enabled, inadvertently exposes a public IP address within network traffic. The attacker must know the victim's AnyDesk ID. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://download.anydesk.com/changelog.txt - https://github.com/ebrasha/abdal-anydesk-remote-ip-detector - https://x.com/ProfShafiei/status/1850856458017009830
CVE ID: CVE-2024-52941 State: PUBLISHED Published: 2024-11-18T00:00:00 Last Updated: 2024-11-18T15:53:55.041Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AC:L/AV:N/A:N/C:L/I:L/PR:L/S:C/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Veritas Enterprise Vault before 15.1 UPD882911, ZDI-CAN-24695. It allows an authenticated remote attacker to inject a parameter into an HTTP request, allowing for Cross-Site Scripting (XSS) while viewing archived content. This could reflect back to an authenticated user without sanitization if executed by that user. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.veritas.com/support/en_US/security/V
user. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.veritas.com/support/en_US/security/VTS24-013
CVE ID: CVE-2024-52942 State: PUBLISHED Published: 2024-11-18T00:00:00 Last Updated: 2024-11-18T15:51:21.931Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AC:L/AV:N/A:N/C:L/I:L/PR:L/S:C/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Veritas Enterprise Vault before 15.1 UPD882911, ZDI-CAN-24696. It allows an authenticated remote attacker to inject a parameter into an HTTP request, allowing for Cross-Site Scripting (XSS) while viewing archived content. This could reflect back to an authenticated user without sanitization if executed by that user. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.veritas.com/support/en_US/security/V
CVE ID: CVE-2024-52943 State: PUBLISHED Published: 2024-11-18T00:00:00.000Z Last Updated: 2025-03-18T19:29:30.756Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AC:L/AV:N/A:N/C:L/I:L/PR:L/S:C/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Veritas Enterprise Vault before 15.1 UPD882911, ZDI-CAN-24697. It allows an authenticated remote attacker to inject a parameter into an HTTP request, allowing for Cross-Site Scripting (XSS) while viewing archived content. This could reflect back to an authenticated user without sanitization if executed by that user. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.veritas.com/support/en_US/secur
that user. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.veritas.com/support/en_US/security/VTS24-013
CVE ID: CVE-2024-52944 State: PUBLISHED Published: 2024-11-18T00:00:00 Last Updated: 2024-11-19T15:49:04.266Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AC:L/AV:N/A:N/C:L/I:L/PR:L/S:C/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Veritas Enterprise Vault before 15.1 UPD882911, ZDI-CAN-24698. It allows an authenticated remote attacker to inject a parameter into an HTTP request, allowing for Cross-Site Scripting while viewing archived content. This could reflect back to an authenticated user without sanitization if executed by that user. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.veritas.com/support/en_US/security/VTS24-0
Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.veritas.com/support/en_US/security/VTS24-013
CVE ID: CVE-2024-52945 State: PUBLISHED Published: 2024-11-18T00:00:00 Last Updated: 2024-11-19T15:43:05.461Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AC:L/AV:L/A:H/C:H/I:H/PR:N/S:U/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Veritas NetBackup before 10.5. This only applies to NetBackup components running on a Windows Operating System. If a user executes specific NetBackup commands or an attacker uses social engineering techniques to impel the user to execute the commands, a malicious DLL could be loaded, resulting in execution of the attacker's code in the user's security context. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https
e attacker's code in the user's security context. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.veritas.com/content/support/en_US/security/VTS24-012
CVE ID: CVE-2024-52946 State: PUBLISHED Published: 2024-11-18T00:00:00.000Z Last Updated: 2025-11-03T22:28:41.701Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in LemonLDAP::NG before 2.20.1. An Improper Check during session refresh allows an authenticated user to raise their authentication level if the admin configured an "Adaptative authentication rule" with an increment instead of an absolute value. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/issues/3255
CVE ID: CVE-2024-52947 State: PUBLISHED Published: 2024-11-18T00:00:00.000Z Last Updated: 2025-11-03T22:28:43.138Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in LemonLDAP::NG before 2.20.1 allows remote attackers to inject arbitrary web script or HTML via the url parameter of the upgrade session confirmation page (upgradeSession / forceUpgrade) if the "Upgrade session" plugin has been enabled by an admin Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/issues/3257
CVE ID: CVE-2024-52949 State: PUBLISHED Published: 2024-12-16T00:00:00.000Z Last Updated: 2025-04-03T15:17:11.356Z Vendors: n/a Products: n/a Problem Types: n/a Description: iptraf-ng 1.2.1 has a stack-based buffer overflow. In src/ifaces.c, the strcpy function consistently fails to control the size, and it is consequently possible to overflow memory on the stack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.gruppotim.it/it/footer/red-team.html - https://github.com/iptraf-ng/iptraf-ng/releases/tag/v1.2.1
CVE ID: CVE-2024-52951 State: PUBLISHED Published: 2024-11-27T00:00:00 Last Updated: 2024-11-27T21:02:40.713Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stored Cross-Site Scripting in the Access Request History in Omada Identity before version 15 update 1 allows an authenticated attacker to execute arbitrary code in the browser of a victim via a specially crafted link or by viewing a manipulated Access Request History Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://omadaidentity.com - https://r.sec-consult.com/omada - https://sec-consult.com/vulnerability-lab/advisory/stored-cross-site-scripting-in-omada-identity/
CVE ID: CVE-2024-52958 State: PUBLISHED Published: 2024-11-27T05:22:47.950Z Last Updated: 2024-11-27T14:46:28.815Z Vendors: Galaxy Software Services Corporation Products: iota C.ai Conversational Platform Problem Types: CWE-347 Description: A improper verification of cryptographic signature vulnerability in plugin management in iota C.ai Conversational Platform from 1.0.0 through 2.1.3 allows remote authenticated users to load a malicious DLL via upload plugin function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://zuso.ai/advisory/za-2024-11
CVE ID: CVE-2024-52959 State: PUBLISHED Published: 2024-11-27T05:23:11.281Z Last Updated: 2024-11-27T14:44:37.184Z Vendors: Galaxy Software Services Corporation Products: iota C.ai Conversational Platform Problem Types: CWE-94 Description: A Improper Control of Generation of Code ('Code Injection') vulnerability in plugin management in iota C.ai Conversational Platform from 1.0.0 through 2.1.3 allows remote authenticated users to perform arbitrary system commands via a DLL file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://zuso.ai/advisory/za-2024-12
CVE ID: CVE-2024-52960 State: PUBLISHED Published: 2025-03-11T14:54:35.614Z Last Updated: 2025-03-11T16:05:31.804Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:F/RL:X/RC:X) Vendors: Fortinet Products: FortiSandbox Problem Types: CWE-602 Description: A client-side enforcement of server-side security vulnerability [CWE-602] in Fortinet FortiSandbox version 5.0.0, 4.4.0 through 4.4.6 and before 4.2.7 allows an authenticated attacker with at least read-only permission to execute unauthorized commands via crafted requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-24-305
CVE ID: CVE-2024-52961 State: PUBLISHED Published: 2025-03-11T14:54:30.498Z Last Updated: 2025-03-12T04:00:57.521Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:X/RC:C) Vendors: Fortinet Products: FortiSandbox Problem Types: CWE-78 Description: An improper neutralization of special elements used in an OS Command vulnerability [CWE-78] in Fortinet FortiSandbox version 5.0.0, 4.4.0 through 4.4.7, 4.2.0 through 4.2.7 and before 4.0.5 allows an authenticated attacker with at least read-only permission to execute unauthorized commands via crafted requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-24
equests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-24-306
CVE ID: CVE-2024-52962 State: PUBLISHED Published: 2025-04-08T14:03:34.946Z Last Updated: 2025-04-08T14:27:48.420Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C) Vendors: Fortinet Products: FortiAnalyzer, FortiManager Problem Types: CWE-117 Description: An Improper Output Neutralization for Logs vulnerability [CWE-117] in FortiAnalyzer version 7.6.1 and below, version 7.4.5 and below, version 7.2.8 and below, version 7.0.13 and below and FortiManager version 7.6.1 and below, version 7.4.5 and below, version 7.2.8 and below, version 7.0.12 and below may allow an unauthenticated remote attacker to pollute the logs via crafted login requests. Additional Ana
12 and below may allow an unauthenticated remote attacker to pollute the logs via crafted login requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-24-453
CVE ID: CVE-2024-52963 State: PUBLISHED Published: 2025-01-14T14:08:31.001Z Last Updated: 2025-01-14T20:57:21.296Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L/E:F/RL:W/RC:C) Vendors: Fortinet Products: FortiProxy, FortiOS, FortiPAM Problem Types: CWE-787 Description: A out-of-bounds write in Fortinet FortiOS versions 7.6.0, 7.4.0 through 7.4.6, 7.2.0 through 7.2.10, 7.0.0 through 7.0.16, 6.4.0 through 6.4.15 allows attacker to trigger a denial of service via specially crafted packets. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-24-373
CVE ID: CVE-2024-52964 State: PUBLISHED Published: 2025-08-12T18:59:45.473Z Last Updated: 2025-08-13T20:13:55.667Z Severity: MEDIUM (CVSS 5.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H/E:P/RL:X/RC:C) Vendors: Fortinet Products: FortiManager Problem Types: CWE-22 Description: An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability [CWE-22] in Fortinet FortiManager version 7.6.0 through 7.6.1, 7.4.0 through 7.4.5, 7.2.0 through 7.2.9 and below 7.0.13 & FortiManager Cloud version 7.6.0 through 7.6.1, 7.4.0 through 7.4.5 and before 7.2.9 allows an authenticated remote attacker to overwrite arbitrary files via FGFM crafted requests. Additional Analyst Not
9 allows an authenticated remote attacker to overwrite arbitrary files via FGFM crafted requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-24-473
CVE ID: CVE-2024-52965 State: PUBLISHED Published: 2025-07-08T14:41:38.347Z Last Updated: 2025-07-08T20:41:57.917Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:C) Vendors: Fortinet Products: FortiOS, FortiProxy Problem Types: CWE-304 Description: A missing critical step in authentication vulnerability [CWE-304] in Fortinet FortiOS version 7.6.0 through 7.6.1, 7.4.0 through 7.4.5, 7.2.0 through 7.2.10, and before 7.0.16 & FortiProxy version 7.6.0 through 7.6.1, 7.4.0 through 7.4.8, 7.2.0 through 7.2.13 and before 7.0.20 allows an API-user using api-key + PKI user certificate authentication to login even if the certificate is invalid. Additional Analyst N
er using api-key + PKI user certificate authentication to login even if the certificate is invalid. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-24-511
CVE ID: CVE-2024-52966 State: PUBLISHED Published: 2025-02-11T16:09:01.588Z Last Updated: 2025-02-12T15:52:16.294Z Severity: LOW (CVSS 2.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N/E:H/RL:O/RC:C) Vendors: Fortinet Products: FortiAnalyzer Problem Types: CWE-200 Description: An exposure of sensitive information to an unauthorized actor in Fortinet FortiAnalyzer 6.4.0 through 7.6.0 allows attacker to cause information disclosure via filter manipulation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-24-422
CVE ID: CVE-2024-52967 State: PUBLISHED Published: 2025-01-14T14:09:44.113Z Last Updated: 2025-01-14T20:54:08.452Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N/E:F/RL:O/RC:C) Vendors: Fortinet Products: FortiPortal Problem Types: CWE-80 Description: An improper neutralization of script-related html tags in a web page (basic xss) in Fortinet FortiPortal 6.0.0 through 6.0.14 allows attacker to execute unauthorized code or commands via html injection. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-24-211
CVE ID: CVE-2024-52968 State: PUBLISHED Published: 2025-02-11T16:09:00.587Z Last Updated: 2025-02-11T16:35:11.996Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:R) Vendors: Fortinet Products: FortiClientMac Problem Types: CWE-287 Description: An improper authentication in Fortinet FortiClientMac 7.0.11 through 7.2.4 allows attacker to gain improper access to MacOS via empty password. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-24-300
CVE ID: CVE-2024-52969 State: PUBLISHED Published: 2025-01-14T14:08:59.640Z Last Updated: 2025-01-14T20:55:36.518Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N/E:P/RL:X/RC:R) Vendors: Fortinet Products: FortiSIEM Problem Types: CWE-89 Description: An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] in FortiSIEM ersion 7.1.7 and below, version 7.1.0, version 7.0.3 and below, version 6.7.9 and below, 6.7.8, version 6.6.5 and below, version 6.5.3 and below, version 6.4.4 and below Update/Create Case feature may allow an authenticated attacker to extract database information via crafted requests. Additional Analys
Case feature may allow an authenticated attacker to extract database information via crafted requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-24-417
CVE ID: CVE-2024-52972 State: PUBLISHED Published: 2025-01-23T06:11:10.715Z Last Updated: 2025-01-23T14:46:31.496Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Elastic Products: Kibana Problem Types: CWE-770 Description: An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted request to /api/metrics/snapshot. This can be carried out by users with read access to the Observability Metrics or Logs features in Kibana. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://discuss.elastic.co/t/kibana-7-17-23-8-15-0-security-updates-esa-2024-32-esa-2024-33/373548
CVE ID: CVE-2024-52973 State: PUBLISHED Published: 2025-01-21T11:04:06.547Z Last Updated: 2025-01-21T16:25:27.782Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Elastic Products: Kibana Problem Types: CWE-770 Description: An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted request to /api/log_entries/summary. This can be carried out by users with read access to the Observability-Logs feature in Kibana. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://discuss.elastic.co/t/kibana-7-17-23-and-8-14-2-security-update-esa-2024-26/373443