Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-53936 State: PUBLISHED Published: 2025-01-06T00:00:00 Last Updated: 2025-01-08T17:31:30.360Z Vendors: n/a Products: n/a Problem Types: n/a Description: The com.asianmobile.callcolor (aka Color Phone Call Screen App) application through 24 for Android enables any application (with no permissions) to place phone calls without user interaction by sending a crafted intent via the com.asianmobile.callcolor.ui.component.call.CallActivity component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/actuator/com.asianmobile.callcolor - https://github.com/actuator/com.asianmobile.callcolor/blob/main/CVE-2024-53936
CVE ID: CVE-2024-53937 State: PUBLISHED Published: 2024-12-02T00:00:00 Last Updated: 2024-12-03T18:52:23.081Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Victure RX1800 WiFi 6 Router (software EN_V1.0.0_r12_110933, hardware 1.0) devices. The TELNET service is enabled by default with admin/admin as default credentials and is exposed over the LAN. The allows attackers to execute arbitrary commands with root-level permissions. Device setup does not require this password to be changed during setup in order to utilize the device. (However, the TELNET password is dictated by the current GUI password.) Additional Analyst Notes: - CISA ADP Vulnrichment: Refe
r, the TELNET password is dictated by the current GUI password.) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/actuator/cve/blob/main/Victure/Victure_RX1800_Security_Report.pdf - https://github.com/actuator/cve/blob/main/Victure/CVE-2024-53937.txt
CVE ID: CVE-2024-53938 State: PUBLISHED Published: 2024-12-02T00:00:00 Last Updated: 2024-12-03T18:58:39.026Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Victure RX1800 WiFi 6 Router (software EN_V1.0.0_r12_110933, hardware 1.0) devices. The TELNET service is enabled by default and exposed over the LAN. The root account is accessible without a password, allowing attackers to achieve full control over the router remotely without any authentication. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/actuator/cve/blob/main/Victure/Victure_RX1800_Security_Report.pdf - https://github.com/actuator/cve/blob/main/Victure/CVE-
tuator/cve/blob/main/Victure/Victure_RX1800_Security_Report.pdf - https://github.com/actuator/cve/blob/main/Victure/CVE-2024-53938.txt
CVE ID: CVE-2024-53939 State: PUBLISHED Published: 2024-12-02T00:00:00 Last Updated: 2024-12-03T18:54:24.260Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Victure RX1800 WiFi 6 Router (software EN_V1.0.0_r12_110933, hardware 1.0) devices. The /cgi-bin/luci/admin/opsw/Dual_freq_un_apple endpoint is vulnerable to command injection through the 2.4 GHz and 5 GHz name parameters, allowing an attacker to execute arbitrary commands on the device (with root-level permissions) via crafted input. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/actuator/cve/blob/main/Victure/CVE-2024-53939.txt - https://github.com/actuator/cve
nt: References: - https://github.com/actuator/cve/blob/main/Victure/CVE-2024-53939.txt - https://github.com/actuator/cve/blob/main/Victure/Victure_RX1800_Security_Report.pdf - https://github.com/actuator/cve/blob/main/Victure/RX1800-EN_V1.0.0_r12_110933-CMD-INJ-WIFI-SHELL.gif
CVE ID: CVE-2024-53940 State: PUBLISHED Published: 2024-12-02T00:00:00 Last Updated: 2024-12-03T18:48:22.719Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Victure RX1800 WiFi 6 Router (software EN_V1.0.0_r12_110933, hardware 1.0) devices. Certain /cgi-bin/luci/admin endpoints are vulnerable to command injection. Attackers can exploit this by sending crafted payloads through parameters intended for the ping utility, enabling arbitrary command execution with root-level permissions on the device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/actuator/cve/blob/main/Victure/CVE-2024-53940.txt
CVE ID: CVE-2024-53941 State: PUBLISHED Published: 2024-12-02T00:00:00 Last Updated: 2024-12-03T18:50:25.819Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Victure RX1800 WiFi 6 Router (software EN_V1.0.0_r12_110933, hardware 1.0) devices. A remote attacker (in proximity to a Wi-Fi network) can derive the default Wi-Fi PSK value via the last 4 octets of the BSSID. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/actuator/cve/blob/main/Victure/Victure_RX1800_Security_Report.pdf - https://github.com/actuator/cve/blob/main/Victure/CVE-2024-53941.txt
CVE ID: CVE-2024-53942 State: PUBLISHED Published: 2025-02-03T00:00:00.000Z Last Updated: 2025-03-18T15:58:25.625Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on NRadio N8-180 NROS-1.9.2.n3.c5 devices. The /cgi-bin/luci/nradio/basic/radio endpoint is vulnerable to command injection via the 2.4 GHz and 5 GHz name parameters, allowing a remote attacker to execute arbitrary OS commands on the device (with root-level permissions) via crafted input. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nradiowifi.net/article/9.html - https://github.com/actuator/cve/blob/main/NRADIO/CVE-2024-53942.txt - https://github.com/actuator/cve/b
article/9.html - https://github.com/actuator/cve/blob/main/NRADIO/CVE-2024-53942.txt - https://github.com/actuator/cve/blob/main/NRADIO/N8-180Firmware-Version-NROS-1.9.2.n3.c5-blind-cmd-injection-outputRedirect.gif
CVE ID: CVE-2024-53943 State: PUBLISHED Published: 2025-02-03T00:00:00.000Z Last Updated: 2025-02-05T18:22:53.226Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in NRadio N8-180 NROS-1.9.2.n3.c5 devices. The /cgi-bin/luci/nradio/basic/radio endpoint is vulnerable to XSS via the 2.4 GHz and 5 GHz name parameters, allowing an attacker to execute JavaScript within the context of the current user by injecting JavaScript into the SSID field. If an administrator logs into the device, the injected script runs in their browser, executing the malicious payload. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nradiowifi.net/article/9.ht
icious payload. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nradiowifi.net/article/9.html - https://github.com/actuator/cve/blob/main/NRADIO/CVE-2024-53943.txt - https://github.com/actuator/cve/blob/main/NRADIO/N8-180Firmware-Version-NROS-1.9.2.n3.c5-XSS.gif
CVE ID: CVE-2024-53944 State: PUBLISHED Published: 2025-02-27T00:00:00.000Z Last Updated: 2025-03-04T14:34:58.859Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Tuoshi/Dionlink LT15D 4G Wi-Fi devices through M7628NNxlSPv2xUI_v1.0.1802.10.08_P4 and LT21B devices through M7628xUSAxUIv2_v1.0.1481.15.02_P0. A unauthenticated remote attacker with network access can exploit a command injection vulnerability. The /goform/formJsonAjaxReq endpoint fails to sanitize shell metacharacters sent via JSON parameters, thus allowing attackers to execute arbitrary OS commands with root privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://w
te arbitrary OS commands with root privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://www.tuoshi.net/productview.asp?id=218 - http://www.tuoshi.net/productview.asp?id=226 - https://github.com/actuator/cve/blob/main/Tuoshi/CVE-2024-53944.txt - https://github.com/actuator/cve/blob/main/Tuoshi/CVE-2024-53944-Whitepaper.pdf - https://github.com/actuator/cve/blob/main/Tuoshi/Firmware-M7628NNxISPv2xUI_v1.0.1802.10.08_P4-Blind-CMD-Injection-unauth-WAN.gif
CVE ID: CVE-2024-53945 State: PUBLISHED Published: 2025-08-14T00:00:00.000Z Last Updated: 2025-08-14T18:50:24.073Z Vendors: n/a Products: n/a Problem Types: n/a Description: The KuWFi 4G AC900 LTE router 1.0.13 is vulnerable to command injection on the HTTP API endpoints /goform/formMultiApnSetting and /goform/atCmd. An authenticated attacker can execute arbitrary OS commands with root privileges via shell metacharacters in parameters such as pincode and cmds. Exploitation can lead to full system compromise, including enabling remote access (e.g., enabling telnet). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://kuwfi.com/products/kuwfi-gigabit-wireless-router-4g-lte
al Analyst Notes: - CISA ADP Vulnrichment: References: - https://kuwfi.com/products/kuwfi-gigabit-wireless-router-4g-lte-wifi-router-dual-band-portable-wifi-modem-hotspot-64-user-with-gigabit-wan-lan-rj11-port - https://github.com/actuator/cve/tree/main/Kuwfi - https://github.com/actuator/cve/blob/main/Kuwfi/CVE-2024-53945.txt
CVE ID: CVE-2024-53946 State: PUBLISHED Published: 2025-08-14T00:00:00.000Z Last Updated: 2025-08-14T15:50:12.058Z Vendors: n/a Products: n/a Problem Types: n/a Description: The KuWFi 4G LTE AC900 router 1.0.13 is vulnerable to Cross-Site Request Forgery (CSRF) on its web management interface. This vulnerability allows an attacker to trick an authenticated admin user into performing unauthorized actions, such as exploiting a command injection vulnerability in /goform/formMultiApnSetting. Successful exploitation can also lead to unauthorized configuration changes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://kuwfi.com/products/kuwfi-gigabit-wireless-router-4g-lte-w
Analyst Notes: - CISA ADP Vulnrichment: References: - https://kuwfi.com/products/kuwfi-gigabit-wireless-router-4g-lte-wifi-router-dual-band-portable-wifi-modem-hotspot-64-user-with-gigabit-wan-lan-rj11-port - https://github.com/actuator/cve/tree/main/Kuwfi - https://github.com/actuator/cve/blob/main/Kuwfi/CVE-2024-53946.txt
CVE ID: CVE-2024-53947 State: PUBLISHED Published: 2024-12-09T13:35:09.910Z Last Updated: 2024-12-09T15:05:21.361Z Vendors: Apache Software Foundation Products: Apache Superset Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Superset. Specifically, certain engine-specific functions are not checked, which allows attackers to bypass Apache Superset's SQL authorization. This issue is a follow-up to CVE-2024-39887 with additional disallowed PostgreSQL functions now included: query_to_xml_and_xmlschema, table_to_xml, table_to_xml_and_xmlschema. This issue affects Apache Superset: <4.1.0. Users are reco
_xml_and_xmlschema, table_to_xml, table_to_xml_and_xmlschema. This issue affects Apache Superset: <4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue or add these Postgres functions to the config set DISALLOWED_SQL_FUNCTIONS. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/hj3gfsjh67vqw12nlrshlsym4bkopjmn
CVE ID: CVE-2024-53948 State: PUBLISHED Published: 2024-12-09T13:35:30.932Z Last Updated: 2024-12-09T18:03:42.140Z Vendors: Apache Software Foundation Products: Apache Superset Problem Types: CWE-209 Description: Generation of Error Message Containing analytics metadata Information in Apache Superset. This issue affects Apache Superset: before 4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lists.apache.org/thread/8howpf3png0wrgpls46ggk441oczlfvf
CVE ID: CVE-2024-53949 State: PUBLISHED Published: 2024-12-09T13:35:41.530Z Last Updated: 2025-02-12T09:34:57.804Z Vendors: Apache Software Foundation Products: Apache Superset Problem Types: CWE-863 Description: Improper Authorization vulnerability in Apache Superset when FAB_ADD_SECURITY_API is enabled (disabled by default). Allows for lower privilege users to use this API. issue affects Apache Superset: from 2.0.0 before 4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lists.apache.org/thread/d3scbwmfpzbpm6npnzdw5y4owtqqyq8d
CVE ID: CVE-2024-53951 State: PUBLISHED Published: 2024-12-10T20:51:12.608Z Last Updated: 2024-12-10T21:25:32.938Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: Adobe Products: InDesign Desktop Problem Types: CWE-125 Description: InDesign Desktop versions ID19.5, ID18.5.4 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/securit
CVE ID: CVE-2024-53952 State: PUBLISHED Published: 2024-12-10T20:51:10.408Z Last Updated: 2024-12-10T21:26:40.373Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) Vendors: Adobe Products: InDesign Desktop Problem Types: CWE-476 Description: InDesign Desktop versions ID19.5, ID18.5.4 and earlier are affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial of service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: Refer
s user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/indesign/apsb24-97.html
CVE ID: CVE-2024-53953 State: PUBLISHED Published: 2024-12-10T20:27:45.380Z Last Updated: 2024-12-17T04:55:43.350Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Animate Problem Types: CWE-416 Description: Animate versions 23.0.8, 24.0.5 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/animate/apsb24-96.html
CVE ID: CVE-2024-53954 State: PUBLISHED Published: 2024-12-10T20:27:42.953Z Last Updated: 2024-12-17T04:55:44.535Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Animate Problem Types: CWE-191 Description: Animate versions 23.0.8, 24.0.5 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/animate/apsb24-96.html
CVE ID: CVE-2024-53955 State: PUBLISHED Published: 2024-12-10T21:15:49.980Z Last Updated: 2024-12-17T04:55:54.949Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Bridge Problem Types: CWE-191 Description: Bridge versions 14.1.3, 15.0 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/bridge/apsb24-103.html
CVE ID: CVE-2024-53956 State: PUBLISHED Published: 2024-12-10T21:18:08.121Z Last Updated: 2024-12-17T04:55:56.183Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Premiere Pro Problem Types: CWE-122 Description: Premiere Pro versions 25.0, 24.6.3 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/premiere_pro/apsb24-104.html
CVE ID: CVE-2024-53957 State: PUBLISHED Published: 2024-12-10T21:21:32.309Z Last Updated: 2024-12-11T14:49:03.833Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Substance3D - Painter Problem Types: CWE-122 Description: Substance3D - Painter versions 10.1.1 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/substance3d_painter/apsb24-105.html
CVE ID: CVE-2024-53958 State: PUBLISHED Published: 2024-12-10T21:21:33.207Z Last Updated: 2024-12-11T14:48:53.396Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Substance3D - Painter Problem Types: CWE-787 Description: Substance3D - Painter versions 10.1.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/substance3d_painter/apsb24-105.html
CVE ID: CVE-2024-53959 State: PUBLISHED Published: 2024-12-10T21:26:22.336Z Last Updated: 2024-12-17T04:55:57.426Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Adobe Framemaker Problem Types: CWE-121 Description: Adobe Framemaker versions 2020.7, 2022.5 and earlier are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/framemaker/apsb24-106.html
CVE ID: CVE-2024-53960 State: PUBLISHED Published: 2024-12-10T22:03:55.558Z Last Updated: 2024-12-11T14:47:45.285Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Adobe Products: Adobe Experience Manager Problem Types: CWE-79 Description: Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/secur
CVE ID: CVE-2024-53961 State: PUBLISHED Published: 2024-12-23T20:11:38.875Z Last Updated: 2025-03-25T14:29:09.151Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Adobe Products: ColdFusion Problem Types: CWE-22 Description: ColdFusion versions 2023.11, 2021.17 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access files or directories that are outside of the restricted directory set by the application. This could lead to the disclosure of sensitive information or the manipulation of system d
ctory set by the application. This could lead to the disclosure of sensitive information or the manipulation of system data. Exploitation of this issue requires the admin panel be exposed to the internet. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/coldfusion/apsb24-107.html
CVE ID: CVE-2024-53962 State: PUBLISHED Published: 2025-02-04T23:40:25.748Z Last Updated: 2025-02-12T20:51:31.796Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Adobe Products: Adobe Experience Manager Problem Types: CWE-79 Description: Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.a
e page containing the vulnerable field. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/experience-manager/apsb24-69.html
CVE ID: CVE-2024-53963 State: PUBLISHED Published: 2025-02-04T23:40:14.380Z Last Updated: 2025-02-05T15:23:24.001Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Adobe Products: Adobe Experience Manager Problem Types: CWE-79 Description: Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by a low privileged attacker to execute arbitrary code in the context of the victim's browser session. By manipulating a DOM element through a crafted URL or user input, the attacker can inject malicious scripts that run when the page is rendered. This type of attack requires user
r input, the attacker can inject malicious scripts that run when the page is rendered. This type of attack requires user interaction, as the victim would need to access a manipulated link or input data into a vulnerable page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/experience-manager/apsb24-69.html
CVE ID: CVE-2024-53964 State: PUBLISHED Published: 2025-02-04T23:40:07.362Z Last Updated: 2025-02-05T15:29:07.194Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Adobe Products: Adobe Experience Manager Problem Types: CWE-79 Description: Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.a
CVE ID: CVE-2024-53965 State: PUBLISHED Published: 2025-02-04T23:39:53.628Z Last Updated: 2025-02-05T15:31:04.104Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Adobe Products: Adobe Experience Manager Problem Types: CWE-79 Description: Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by a low privileged attacker to execute arbitrary code in the context of the victim's browser session. By manipulating a DOM element through a crafted URL or user input, the attacker can inject malicious scripts that run when the page is rendered. This type of attack requires user
CVE ID: CVE-2024-53966 State: PUBLISHED Published: 2025-02-04T23:40:11.267Z Last Updated: 2025-02-05T15:28:35.505Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Adobe Products: Adobe Experience Manager Problem Types: CWE-79 Description: Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.a