Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
r integer overflow by supplying large length values because the provided length value is increased by a few bytes to account for additional information that is supposed to be stored there. This bug is trivial to exploit for a denial of service but is not certain to suffice to bring the system down and can generally not be exploited further because the exploitable buffer is dynamically allocated. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/mbed-ce/mbed-os/blob/54e8693ef4ff7e025018094f290a1d5cf380941f/connectivity/FEATURE_BLE/libraries/cordio_stack/ble-host/sources/hci/dual_chip/hci_evt.c#L2748 - https://github.com/mbed-ce/mbed-os/pull/386
CVE ID: CVE-2024-48983 State: PUBLISHED Published: 2024-11-20T00:00:00 Last Updated: 2024-11-25T21:04:38.204Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in MBed OS 6.16.0. During processing of HCI packets, the software dynamically determines the length of the packet data by reading 2 bytes from the packet header. A buffer is then allocated to contain the entire packet, the size of which is calculated as the length of the packet body determined earlier plus the header length. WsfMsgAlloc then increments this again by sizeof(wsfMsg_t). This may cause an integer overflow that results in the buffer being significantly too small to contain the entire packet
This may cause an integer overflow that results in the buffer being significantly too small to contain the entire packet. This may cause a buffer overflow of up to 65 KB . This bug is trivial to exploit for a denial of service but can generally not be exploited further because the exploitable buffer is dynamically allocated. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/mbed-ce/mbed-os/blob/54e8693ef4ff7e025018094f290a1d5cf380941f/connectivity/FEATURE_BLE/libraries/cordio_stack/wsf/sources/port/baremetal/wsf_msg.c#L72 - https://github.com/mbed-ce/mbed-os/pull/388
CVE ID: CVE-2024-48984 State: PUBLISHED Published: 2024-11-20T00:00:00 Last Updated: 2024-11-25T21:09:11.078Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in MBed OS 6.16.0. When parsing hci reports, the hci parsing software dynamically determines the length of a list of reports by reading a byte from an input stream. It then fetches the length of the first report, uses it to calculate the beginning of the second report, etc. In doing this, it tracks the largest report so it can later allocate a buffer that fits every individual report (but only one at a time). It does not, however, validate that these addresses are all contained within the buffer passed
(but only one at a time). It does not, however, validate that these addresses are all contained within the buffer passed to hciEvtProcessLeExtAdvReport. It is then possible, though unlikely, that the buffer designated to hold the reports is allocated in such a way that one of these out-of-bounds length fields is contained within the new buffer. When the (n-1)th report is copied, it overwrites the length field of the nth report. This now corrupted length field is then used for a memcpy into the new buffer, which may lead to a buffer overflow. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/mbed-ce/mbed-os/blob/54e8693ef4ff7e025018094f290a1d5cf380941f/connec
ADP Vulnrichment: References: - https://github.com/mbed-ce/mbed-os/blob/54e8693ef4ff7e025018094f290a1d5cf380941f/connectivity/FEATURE_BLE/libraries/cordio_stack/ble-host/sources/hci/dual_chip/hci_evt.c#L1317 - https://github.com/mbed-ce/mbed-os/pull/387
CVE ID: CVE-2024-48985 State: PUBLISHED Published: 2024-11-20T00:00:00 Last Updated: 2024-11-25T21:08:30.415Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in MBed OS 6.16.0. During processing of HCI packets, the software dynamically determines the length of the packet data by reading 2 bytes from the packet data. A buffer is then allocated to contain the entire packet, the size of which is calculated as the length of the packet body determined earlier and the header length. If the allocate fails because the specified packet is too large, no exception handling occurs and hciTrSerialRxIncoming continues to write bytes into the 4-byte large temporary header
, no exception handling occurs and hciTrSerialRxIncoming continues to write bytes into the 4-byte large temporary header buffer, leading to a buffer overflow. This can be leveraged into an arbitrary write by an attacker. It is possible to overwrite the pointer to the buffer that is supposed to receive the contents of the packet body but which couldn't be allocated. One can then overwrite the state variable used by the function to determine which step of the parsing process is currently being executed. This advances the function to the next state, where it proceeds to copy data to that arbitrary location. The packet body is then written wherever the corrupted data pointer is pointing. Additio
ata to that arbitrary location. The packet body is then written wherever the corrupted data pointer is pointing. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/mbed-ce/mbed-os/blob/54e8693ef4ff7e025018094f290a1d5cf380941f/connectivity/FEATURE_BLE/source/cordio/stack_adaptation/hci_tr.c#L200 - https://github.com/mbed-ce/mbed-os/pull/384
CVE ID: CVE-2024-48986 State: PUBLISHED Published: 2024-11-20T00:00:00 Last Updated: 2024-11-26T15:57:50.159Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in MBed OS 6.16.0. Its hci parsing software dynamically determines the length of certain hci packets by reading a byte from its header. Certain events cause a callback, the logic for which allocates a buffer (the length of which is determined by looking up the event type in a table). The subsequent write operation, however, copies the amount of data specified in the packet header, which may lead to a buffer overflow. This bug is trivial to exploit for a denial of service but is not certain to suffice t
ch may lead to a buffer overflow. This bug is trivial to exploit for a denial of service but is not certain to suffice to bring the system down and can generally not be exploited further because the exploitable buffer is dynamically allocated. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/mbed-ce/mbed-os/blob/54e8693ef4ff7e025018094f290a1d5cf380941f/connectivity/FEATURE_BLE/libraries/cordio_stack/ble-host/sources/hci/dual_chip/hci_evt.c#L3018 - https://github.com/mbed-ce/mbed-os/pull/385
CVE ID: CVE-2024-48987 State: PUBLISHED Published: 2024-10-11T00:00:00.000Z Last Updated: 2025-03-25T15:56:20.566Z Vendors: n/a Products: n/a Problem Types: n/a Description: Snipe-IT before 7.0.10 allows remote code execution (associated with cookie serialization) when an attacker knows the APP_KEY. This is exacerbated by .env files, available from the product's repository, that have default APP_KEY values. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/snipe/snipe-it/releases/tag/v7.0.10 - https://www.synacktiv.com/advisories/snipe-it-unauthenticated-remote-command-execution-when-appkey-known
CVE ID: CVE-2024-48988 State: PUBLISHED Published: 2025-08-22T18:24:22.144Z Last Updated: 2025-11-04T21:09:00.563Z Vendors: Apache Software Foundation Products: Apache StreamPark Problem Types: CWE-564 Description: SQL Injection vulnerability in Apache StreamPark. This issue affects Apache StreamPark: from 2.1.4 before 2.1.6. Users are recommended to upgrade to version 2.1.6, which fixes the issue. This vulnerability is present only in the distribution package (SpringBoot platform) and does not involve Maven artifacts. It can only be exploited after a user has successfully logged into the platform (implying that the attacker would first need to compromise the login authentication). As a resu
logged into the platform (implying that the attacker would first need to compromise the login authentication). As a result, the associated risk is considered relatively low. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lists.apache.org/thread/26ng8388l93zwjrst560cbjz9x7wpq1s
CVE ID: CVE-2024-48989 State: PUBLISHED Published: 2024-11-13T13:39:15.659Z Last Updated: 2024-11-13T14:37:07.826Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Bosch Rexroth AG Products: IndraDrive FWA-INDRV*-MP* Problem Types: CWE-400 Description: A vulnerability in the PROFINET stack implementation of the IndraDrive (all versions) of Bosch Rexroth allows an attacker to cause a denial of service, rendering the device unresponsive by sending arbitrary UDP messages. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://psirt.bosch.com/security-advisories/BOSCH-SA-315415.html
CVE ID: CVE-2024-48990 State: PUBLISHED Published: 2024-11-19T17:38:07.238Z Last Updated: 2025-11-03T22:22:08.006Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: needrestart Products: needrestart Description: Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by tricking needrestart into running the Python interpreter with an attacker-controlled PYTHONPATH environment variable. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.cve.org/CVERecord?id=CVE-2024-48990 - https://github.com/liske/needrestart/commit/fcc9a4401392231bef4ef5ed026a0d7a275149ab
e.org/CVERecord?id=CVE-2024-48990 - https://github.com/liske/needrestart/commit/fcc9a4401392231bef4ef5ed026a0d7a275149ab - https://www.qualys.com/2024/11/19/needrestart/needrestart.txt
CVE ID: CVE-2024-48991 State: PUBLISHED Published: 2024-11-19T17:38:15.691Z Last Updated: 2025-11-03T22:22:10.925Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: needrestart Products: needrestart Description: Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by winning a race condition and tricking needrestart into running their own, fake Python interpreter (instead of the system's real Python interpreter). The initial security fix (6ce6136) introduced a regression which was subsequently resolved (42af5d3). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - h
equently resolved (42af5d3). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.cve.org/CVERecord?id=CVE-2024-48991 - https://github.com/liske/needrestart/commit/6ce6136cccc307c6b8a0f8cae12f9a22ac2aad59 - https://github.com/liske/needrestart/commit/42af5d328901287a4f79d1f5861ac827a53fd56d - https://www.qualys.com/2024/11/19/needrestart/needrestart.txt
CVE ID: CVE-2024-48992 State: PUBLISHED Published: 2024-11-19T17:38:22.267Z Last Updated: 2025-11-03T22:22:13.836Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: needrestart Products: needrestart Description: Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by tricking needrestart into running the Ruby interpreter with an attacker-controlled RUBYLIB environment variable. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.cve.org/CVERecord?id=CVE-2024-48992 - https://github.com/liske/needrestart/commit/b5f25f6ec6e7dd0c5be249e4e45de4ee9ffe594f - ht
/CVERecord?id=CVE-2024-48992 - https://github.com/liske/needrestart/commit/b5f25f6ec6e7dd0c5be249e4e45de4ee9ffe594f - https://www.qualys.com/2024/11/19/needrestart/needrestart.txt
CVE ID: CVE-2024-48993 State: PUBLISHED Published: 2024-11-12T17:54:07.146Z Last Updated: 2025-07-08T15:41:39.411Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft SQL Server 2017 (GDR), Microsoft SQL Server 2019 (GDR), Microsoft SQL Server 2016 Service Pack 3 (GDR), Microsoft SQL Server 2016 Service Pack 3 Azure Connect Feature Pack, Microsoft SQL Server 2017 (CU 31), Microsoft SQL Server 2019 (CU 29) Problem Types: CWE-122 Description: SQL Server Native Client Remote Code Execution Vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE
ditional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-48993
CVE ID: CVE-2024-48994 State: PUBLISHED Published: 2024-11-12T17:53:52.545Z Last Updated: 2025-07-08T15:41:19.924Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft SQL Server 2017 (GDR), Microsoft SQL Server 2019 (GDR), Microsoft SQL Server 2016 Service Pack 3 (GDR), Microsoft SQL Server 2016 Service Pack 3 Azure Connect Feature Pack, Microsoft SQL Server 2017 (CU 31), Microsoft SQL Server 2019 (CU 29) Problem Types: CWE-122 Description: SQL Server Native Client Remote Code Execution Vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE
ditional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-48994
CVE ID: CVE-2024-48995 State: PUBLISHED Published: 2024-11-12T17:53:53.162Z Last Updated: 2025-07-08T15:41:20.769Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft SQL Server 2017 (GDR), Microsoft SQL Server 2019 (GDR), Microsoft SQL Server 2016 Service Pack 3 (GDR), Microsoft SQL Server 2016 Service Pack 3 Azure Connect Feature Pack, Microsoft SQL Server 2017 (CU 31), Microsoft SQL Server 2019 (CU 29) Problem Types: CWE-122 Description: SQL Server Native Client Remote Code Execution Vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE
ditional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-48995
CVE ID: CVE-2024-48996 State: PUBLISHED Published: 2024-11-12T17:53:53.952Z Last Updated: 2025-07-08T15:41:21.418Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft SQL Server 2017 (GDR), Microsoft SQL Server 2019 (GDR), Microsoft SQL Server 2016 Service Pack 3 (GDR), Microsoft SQL Server 2016 Service Pack 3 Azure Connect Feature Pack, Microsoft SQL Server 2017 (CU 31), Microsoft SQL Server 2019 (CU 29) Problem Types: CWE-122 Description: SQL Server Native Client Remote Code Execution Vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE
ditional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-48996
CVE ID: CVE-2024-48997 State: PUBLISHED Published: 2024-11-12T17:54:07.706Z Last Updated: 2025-07-08T15:41:40.062Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft SQL Server 2017 (GDR), Microsoft SQL Server 2019 (GDR), Microsoft SQL Server 2016 Service Pack 3 (GDR), Microsoft SQL Server 2016 Service Pack 3 Azure Connect Feature Pack, Microsoft SQL Server 2017 (CU 31), Microsoft SQL Server 2019 (CU 29) Problem Types: CWE-122 Description: SQL Server Native Client Remote Code Execution Vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE
ditional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-48997
CVE ID: CVE-2024-48998 State: PUBLISHED Published: 2024-11-12T17:54:08.341Z Last Updated: 2025-07-08T15:41:40.721Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft SQL Server 2017 (GDR), Microsoft SQL Server 2019 (GDR), Microsoft SQL Server 2016 Service Pack 3 (GDR), Microsoft SQL Server 2016 Service Pack 3 Azure Connect Feature Pack, Microsoft SQL Server 2017 (CU 31), Microsoft SQL Server 2019 (CU 29) Problem Types: CWE-122 Description: SQL Server Native Client Remote Code Execution Vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE
ditional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-48998
CVE ID: CVE-2024-48999 State: PUBLISHED Published: 2024-11-12T17:54:08.821Z Last Updated: 2025-07-08T15:41:41.369Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft SQL Server 2017 (GDR), Microsoft SQL Server 2019 (GDR), Microsoft SQL Server 2016 Service Pack 3 (GDR), Microsoft SQL Server 2016 Service Pack 3 Azure Connect Feature Pack, Microsoft SQL Server 2017 (CU 31), Microsoft SQL Server 2019 (CU 29) Problem Types: CWE-122 Description: SQL Server Native Client Remote Code Execution Vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE
ditional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-48999
CVE ID: CVE-2024-49000 State: PUBLISHED Published: 2024-11-12T17:54:09.288Z Last Updated: 2025-07-08T15:42:02.142Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft SQL Server 2017 (GDR), Microsoft SQL Server 2019 (GDR), Microsoft SQL Server 2016 Service Pack 3 (GDR), Microsoft SQL Server 2016 Service Pack 3 Azure Connect Feature Pack, Microsoft SQL Server 2017 (CU 31), Microsoft SQL Server 2019 (CU 29) Problem Types: CWE-122 Description: SQL Server Native Client Remote Code Execution Vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE
ditional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49000
CVE ID: CVE-2024-49001 State: PUBLISHED Published: 2024-11-12T17:54:09.822Z Last Updated: 2025-07-08T15:41:41.935Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft SQL Server 2019 (CU 29), Microsoft SQL Server 2017 (GDR), Microsoft SQL Server 2019 (GDR), Microsoft SQL Server 2016 Service Pack 3 (GDR), Microsoft SQL Server 2016 Service Pack 3 Azure Connect Feature Pack, Microsoft SQL Server 2017 (CU 31) Problem Types: CWE-122 Description: SQL Server Native Client Remote Code Execution Vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE
ditional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49001
CVE ID: CVE-2024-49002 State: PUBLISHED Published: 2024-11-12T17:54:10.396Z Last Updated: 2025-07-08T15:41:42.514Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft SQL Server 2017 (GDR), Microsoft SQL Server 2019 (GDR), Microsoft SQL Server 2016 Service Pack 3 (GDR), Microsoft SQL Server 2016 Service Pack 3 Azure Connect Feature Pack, Microsoft SQL Server 2017 (CU 31), Microsoft SQL Server 2019 (CU 29) Problem Types: CWE-122 Description: SQL Server Native Client Remote Code Execution Vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE
ditional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49002
CVE ID: CVE-2024-49003 State: PUBLISHED Published: 2024-11-12T17:54:10.996Z Last Updated: 2025-07-08T15:41:43.114Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft SQL Server 2019 (CU 29), Microsoft SQL Server 2017 (GDR), Microsoft SQL Server 2019 (GDR), Microsoft SQL Server 2016 Service Pack 3 (GDR), Microsoft SQL Server 2016 Service Pack 3 Azure Connect Feature Pack, Microsoft SQL Server 2017 (CU 31) Problem Types: CWE-416 Description: SQL Server Native Client Remote Code Execution Vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE
ditional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49003
CVE ID: CVE-2024-49004 State: PUBLISHED Published: 2024-11-12T17:54:11.537Z Last Updated: 2025-07-08T15:41:43.777Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft SQL Server 2017 (GDR), Microsoft SQL Server 2019 (GDR), Microsoft SQL Server 2016 Service Pack 3 (GDR), Microsoft SQL Server 2016 Service Pack 3 Azure Connect Feature Pack, Microsoft SQL Server 2017 (CU 31), Microsoft SQL Server 2019 (CU 29) Problem Types: CWE-122 Description: SQL Server Native Client Remote Code Execution Vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE
ditional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49004
CVE ID: CVE-2024-49005 State: PUBLISHED Published: 2024-11-12T17:54:12.029Z Last Updated: 2025-07-08T15:41:44.376Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft SQL Server 2017 (GDR), Microsoft SQL Server 2019 (GDR), Microsoft SQL Server 2016 Service Pack 3 (GDR), Microsoft SQL Server 2016 Service Pack 3 Azure Connect Feature Pack, Microsoft SQL Server 2017 (CU 31), Microsoft SQL Server 2019 (CU 29) Problem Types: CWE-122 Description: SQL Server Native Client Remote Code Execution Vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE
ditional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49005
CVE ID: CVE-2024-49006 State: PUBLISHED Published: 2024-11-12T17:54:13.138Z Last Updated: 2025-07-08T15:41:45.536Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft SQL Server 2017 (GDR), Microsoft SQL Server 2019 (GDR), Microsoft SQL Server 2016 Service Pack 3 (GDR), Microsoft SQL Server 2016 Service Pack 3 Azure Connect Feature Pack, Microsoft SQL Server 2017 (CU 31), Microsoft SQL Server 2019 (CU 29) Problem Types: CWE-122 Description: SQL Server Native Client Remote Code Execution Vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE
ditional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49006
CVE ID: CVE-2024-49007 State: PUBLISHED Published: 2024-11-12T17:54:12.607Z Last Updated: 2025-07-08T15:41:44.951Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft SQL Server 2017 (GDR), Microsoft SQL Server 2019 (GDR), Microsoft SQL Server 2016 Service Pack 3 (GDR), Microsoft SQL Server 2016 Service Pack 3 Azure Connect Feature Pack, Microsoft SQL Server 2017 (CU 31), Microsoft SQL Server 2019 (CU 29) Problem Types: CWE-122 Description: SQL Server Native Client Remote Code Execution Vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE
ditional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49007