Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-22052 State: PUBLISHED Published: 2024-04-04T19:45:10.169Z Last Updated: 2024-10-03T21:40:23.298Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Ivanti Products: Connect Secure, Policy Secure Description: A null pointer dereference vulnerability in IPSec component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure allows an unauthenticated malicious user to send specially crafted requests in-order-to crash the service thereby causing a DoS attack Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://forums.ivanti.com/s/article/New-CVE-2024-21894-Heap-Overflow-CVE-2024-22052-Null-Pointer-D
tainer: References: - https://forums.ivanti.com/s/article/New-CVE-2024-21894-Heap-Overflow-CVE-2024-22052-Null-Pointer-Dereference-CVE-2024-22053-Heap-Overflow-and-CVE-2024-22023-XML-entity-expansion-or-XXE-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US
CVE ID: CVE-2024-22053 State: PUBLISHED Published: 2024-04-04T19:45:10.175Z Last Updated: 2024-10-03T21:40:00.903Z Severity: HIGH (CVSS 8.2 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H) Vendors: Ivanti Products: Connect Secure, Policy Secure Description: A heap overflow vulnerability in IPSec component of Ivanti Connect Secure (9.x 22.x) and Ivanti Policy Secure allows an unauthenticated malicious user to send specially crafted requests in-order-to crash the service thereby causing a DoS attack or in certain conditions read contents from memory. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://forums.ivanti.com/s/article/New-CVE-2024-21894-Hea
CISA ADP Vulnrichment: - CVE Program Container: References: - https://forums.ivanti.com/s/article/New-CVE-2024-21894-Heap-Overflow-CVE-2024-22052-Null-Pointer-Dereference-CVE-2024-22053-Heap-Overflow-and-CVE-2024-22023-XML-entity-expansion-or-XXE-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US
CVE ID: CVE-2024-22054 State: PUBLISHED Published: 2024-02-20T17:14:34.212Z Last Updated: 2025-03-27T20:55:19.431Z Vendors: Ubiquiti Inc Products: UniFi Access Points, UniFi Switches, UniFi LTE Backup, UniFi Express Description: A malformed discovery packet sent by a malicious actor with preexisting access to the network could interrupt the functionality of device management and discovery. Affected Products: UniFi Access Points UniFi Switches UniFi LTE Backup UniFi Express (Only Mesh Mode, Router mode is not affected) Mitigation: Update UniFi Access Points to Version 6.6.55 or later. Update UniFi Switches to Version 6.6.61 or later. Update UniFi LTE Backup to Version 6.6.57 or later. Update
or later. Update UniFi Switches to Version 6.6.61 or later. Update UniFi LTE Backup to Version 6.6.57 or later. Update UniFi Express to Version 3.2.5 or later. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://community.ui.com/releases/Security-Advisory-Bulletin-037-037/9aeeccef-ca4a-4f10-9f66-1eb400b3d027
CVE ID: CVE-2024-22058 State: PUBLISHED Published: 2024-05-31T17:38:31.334Z Last Updated: 2025-03-17T15:41:54.663Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Ivanti Products: EPM Description: A buffer overflow allows a low privilege user on the local machine that has the EPM Agent installed to execute arbitrary code with elevated permissions in Ivanti EPM 2021.1 and older. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://forums.ivanti.com/s/article/CVE-2024-22058-Privilege-Escalation-for-Ivanti-Endpoint-Manager-EPM
CVE ID: CVE-2024-22059 State: PUBLISHED Published: 2024-05-31T17:38:31.425Z Last Updated: 2024-08-01T22:35:34.845Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Ivanti Products: ITSM Description: A SQL injection vulnerability in web component of Ivanti Neurons for ITSM allows a remote authenticated user to read/modify/delete information in the underlying database. This may also lead to DoS. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://forums.ivanti.com/s/article/Security-Advisory-May-2024
CVE ID: CVE-2024-22060 State: PUBLISHED Published: 2024-05-31T17:38:31.402Z Last Updated: 2024-08-25T14:58:44.653Z Severity: HIGH (CVSS 8.7 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H) Vendors: Ivanti Products: ITSM Description: An unrestricted file upload vulnerability in web component of Ivanti Neurons for ITSM allows a remote, authenticated, high privileged user to write arbitrary files into sensitive directories of ITSM server. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-May-2024
CVE ID: CVE-2024-22061 State: PUBLISHED Published: 2024-04-19T01:10:30.635Z Last Updated: 2024-08-01T22:35:34.718Z Severity: HIGH (CVSS 8.1 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Ivanti Products: Avalanche Description: A Heap Overflow vulnerability in WLInfoRailService component of Ivanti Avalanche before 6.4.3 allows a remote unauthenticated attacker to execute arbitrary commands Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://forums.ivanti.com/s/article/Avalanche-6-4-3-Security-Hardening-and-CVEs-addressed?language=en_US
CVE ID: CVE-2024-22062 State: PUBLISHED Published: 2024-07-09T06:41:07.828Z Last Updated: 2024-08-01T22:35:34.788Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L) Vendors: ZTE Products: ZXCLOUD IRAI Problem Types: CWE-346 Description: There is a permissions and access control vulnerability in ZXCLOUD IRAI.An attacker can elevate non-administrator permissions to administrator permissions by modifying the configuration. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1036204
CVE ID: CVE-2024-22063 State: PUBLISHED Published: 2024-12-30T09:30:22.099Z Last Updated: 2024-12-30T16:23:58.054Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H) Vendors: ZTE Products: ZENIC ONE R58 Problem Types: CWE-1236 Description: The ZENIC ONE R58 products by ZTE Corporation have a command injection vulnerability. An authenticated attacker can exploit this vulnerability to tamper with messages, inject malicious code, and subsequently launch attacks on related devices. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/4522216612187627521
CVE ID: CVE-2024-22064 State: PUBLISHED Published: 2024-05-10T12:28:16.445Z Last Updated: 2024-08-01T22:35:34.708Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L) Vendors: ZTE Products: ZXUN-ePDG Problem Types: CWE-1051 Description: ZTE ZXUN-ePDG product, which serves as the network node of the VoWifi system, under by default configuration, uses a set of non-unique cryptographic keys during establishing a secure connection(IKE) with the mobile devices connecting over the internet . If the set of keys are leaked or cracked, the user session informations using the keys may be leaked. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References:
s using the keys may be leaked. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1035524
CVE ID: CVE-2024-22065 State: PUBLISHED Published: 2024-10-29T01:58:29.002Z Last Updated: 2024-10-29T13:29:22.586Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: ZTE Products: MF258 Pro Problem Types: CWE-20 Description: There is a command injection vulnerability in ZTE MF258 Pro product. Due to insufficient validation of Ping Diagnosis interface parameter, an authenticated attacker could use the vulnerability to execute arbitrary commands. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/1171513586716225572
CVE ID: CVE-2024-22066 State: PUBLISHED Published: 2024-10-29T09:03:36.687Z Last Updated: 2024-10-29T15:06:23.937Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: ZTE Products: ZXR10 1800-2S Problem Types: CWE-294 Description: There is a privilege escalation vulnerability in ZTE ZXR10 ZSR V2 intelligent multi service router . An authenticated attacker could use the vulnerability to obtain sensitive information about the device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/1171513586716225590
CVE ID: CVE-2024-22067 State: PUBLISHED Published: 2024-11-18T06:45:47.446Z Last Updated: 2025-03-13T16:17:07.454Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: ZTE Products: NH8091 Problem Types: CVE-2024-22067 Description: ZTE NH8091 product has an improper permission control vulnerability. Due to improper permission control of the Web module interface, an authenticated attacker may exploit the vulnerability to execute arbitrary commands. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/6179526095692935173
CVE ID: CVE-2024-22068 State: PUBLISHED Published: 2024-10-10T08:51:35.299Z Last Updated: 2024-10-10T13:38:50.810Z Severity: MEDIUM (CVSS 6 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:H) Vendors: ZTE Products: ZXR10 1800-2S series ,ZXR10 2800-4,ZXR10 3800-8,ZXR10 160 series Problem Types: CWE-269 Description: Improper Privilege Management vulnerability in ZTE ZXR10 1800-2S series ,ZXR10 2800-4,ZXR10 3800-8,ZXR10 160 series on 64 bit allows Functionality Bypass.This issue affects ZXR10 1800-2S series ,ZXR10 2800-4,ZXR10 3800-8,ZXR10 160 series: V4.00.10 and earlier. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/deta
l Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/5359853646778130472
CVE ID: CVE-2024-22069 State: PUBLISHED Published: 2024-08-08T07:54:50.319Z Last Updated: 2024-08-08T13:07:14.051Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:L) Vendors: ZTE Products: ZXV10 XT802, ZXV10 ET301 Problem Types: CWE-269 Description: There is a permission and access control vulnerability of ZTE's ZXV10 XT802/ET301 product.Attackers with common permissions can log in the terminal web and change the password of the administrator illegally by intercepting requests to change the passwords. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1036424
CVE ID: CVE-2024-22074 State: PUBLISHED Published: 2024-06-06T20:45:58.421Z Last Updated: 2025-03-18T20:48:10.151Z Vendors: n/a Products: n/a Problem Types: n/a Description: Dynamsoft Service 1.8.1025 through 1.8.2013, 1.7.0330 through 1.7.2531, 1.6.0428 through 1.6.1112, 1.5.0625 through 1.5.3116, 1.4.0618 through 1.4.1230, and 1.0.516 through 1.3.0115 has Incorrect Access Control. This is fixed in 1.8.2014, 1.7.4212, 1.6.3212, 1.5.31212, 1.4.3212, and 1.3.3212. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.dynamsoft.com/support/security-bulletin-dwt-2024-22074/
CVE ID: CVE-2024-22075 State: PUBLISHED Published: 2024-01-05T00:00:00.000Z Last Updated: 2025-06-05T16:18:14.218Z Vendors: n/a Products: n/a Problem Types: n/a Description: Firefly III (aka firefly-iii) before 6.1.1 allows webhooks HTML Injection. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/firefly-iii/firefly-iii/releases/tag/v6.1.1 - https://www.sonarsource.com/blog/front-end-frameworks-when-bypassing-built-in-sanitization-might-backfire/
CVE ID: CVE-2024-22076 State: PUBLISHED Published: 2024-01-23T00:00:00.000Z Last Updated: 2025-06-16T19:43:46.833Z Vendors: n/a Products: n/a Problem Types: n/a Description: MyQ Print Server before 8.2 patch 43 allows remote authenticated administrators to execute arbitrary code via PHP scripts that are reached through the administrative interface. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://docs.myq-solution.com/en/print-server/8.2/ - https://docs.myq-solution.com/en/print-server/8.2/technical-changelog#id-%288.2%29ReleaseNotes-8.2%28Patch43%29 - https://www.access42.nl/nieuws/unmasking-web-vulnerabilities-a-tale-of-default-admin-credent
aseNotes-8.2%28Patch43%29 - https://www.access42.nl/nieuws/unmasking-web-vulnerabilities-a-tale-of-default-admin-credentials-and-php-command-execution-cve-2024-22076/
CVE ID: CVE-2024-22077 State: PUBLISHED Published: 2024-03-20T00:00:00 Last Updated: 2024-08-03T19:38:50.302Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Elspec G5 digital fault recorder versions 1.1.4.15 and before. The SQLite database file has weak permissions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.elspec-ltd.com/support/security-advisories/
CVE ID: CVE-2024-22078 State: PUBLISHED Published: 2024-03-20T00:00:00 Last Updated: 2024-08-03T19:40:29.520Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Elspec G5 digital fault recorder versions 1.1.4.15 and before. Privilege escalation can occur via world writable files. The network configuration script has weak filesystem permissions. This results in write access for all authenticated users and the possibility to escalate from user privileges to administrative privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.elspec-ltd.com/support/security-advisories/
CVE ID: CVE-2024-22079 State: PUBLISHED Published: 2024-03-20T00:00:00 Last Updated: 2024-08-05T16:21:15.710Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Elspec G5 digital fault recorder versions 1.1.4.15 and before. Directory traversal can occur via the system logs download mechanism. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.elspec-ltd.com/support/security-advisories/
CVE ID: CVE-2024-22080 State: PUBLISHED Published: 2024-03-20T00:00:00 Last Updated: 2024-08-03T19:35:27.939Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Elspec G5 digital fault recorder versions 1.1.4.15 and before. Unauthenticated memory corruption can occur during XML body parsing. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.elspec-ltd.com/support/security-advisories/
CVE ID: CVE-2024-22081 State: PUBLISHED Published: 2024-03-20T00:00:00 Last Updated: 2024-10-28T18:55:42.071Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Elspec G5 digital fault recorder versions 1.1.4.15 and before. Unauthenticated memory corruption can occur in the HTTP header parsing mechanism. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.elspec-ltd.com/support/security-advisories/
CVE ID: CVE-2024-22082 State: PUBLISHED Published: 2024-03-20T00:00:00 Last Updated: 2024-08-05T18:32:22.555Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Elspec G5 digital fault recorder versions 1.1.4.15 and before. Unauthenticated directory listing can occur: the web interface cay be abused be an attacker get a better understanding of the operating system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.elspec-ltd.com/support/security-advisories/
CVE ID: CVE-2024-22083 State: PUBLISHED Published: 2024-03-20T00:00:00 Last Updated: 2024-11-18T18:45:25.456Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Elspec G5 digital fault recorder versions 1.1.4.15 and before. A hardcoded backdoor session ID exists that can be used for further access to the device, including reconfiguration tasks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.elspec-ltd.com/support/security-advisories/
CVE ID: CVE-2024-22084 State: PUBLISHED Published: 2024-03-20T00:00:00 Last Updated: 2024-08-03T19:36:14.883Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Elspec G5 digital fault recorder versions 1.1.4.15 and before. Cleartext passwords and hashes are exposed through log files. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.elspec-ltd.com/support/security-advisories/
CVE ID: CVE-2024-22085 State: PUBLISHED Published: 2024-03-20T00:00:00 Last Updated: 2024-12-05T20:25:53.852Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Elspec G5 digital fault recorder versions 1.1.4.15 and before. The shadow file is world readable. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.elspec-ltd.com/support/security-advisories/
CVE ID: CVE-2024-22086 State: PUBLISHED Published: 2024-01-05T00:00:00.000Z Last Updated: 2025-06-18T15:49:21.965Z Vendors: n/a Products: n/a Problem Types: n/a Description: handle_request in http.c in cherry through 4b877df has an sscanf stack-based buffer overflow via a long URI, leading to remote code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/hayyp/cherry/issues/1
CVE ID: CVE-2024-22087 State: PUBLISHED Published: 2024-01-05T00:00:00.000Z Last Updated: 2025-06-03T14:41:47.973Z Vendors: n/a Products: n/a Problem Types: n/a Description: route in main.c in Pico HTTP Server in C through f3b69a6 has an sprintf stack-based buffer overflow via a long URI, leading to remote code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/foxweb/pico/issues/31
CVE ID: CVE-2024-22088 State: PUBLISHED Published: 2024-01-05T00:00:00 Last Updated: 2024-09-04T20:23:55.461Z Vendors: n/a Products: n/a Problem Types: n/a Description: Lotos WebServer through 0.1.1 (commit 3eb36cc) has a use-after-free in buffer_avail() at buffer.h via a long URI, because realloc is mishandled. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/chendotjs/lotos/issues/7
CVE ID: CVE-2024-22091 State: PUBLISHED Published: 2024-04-26T08:24:34.049Z Last Updated: 2024-08-01T22:35:34.806Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: Mattermost Products: Mattermost Problem Types: CWE-400 Description: Mattermost versions 8.1.x <= 8.1.10, 9.6.x <= 9.6.0, 9.5.x <= 9.5.2 and 8.1.x <= 8.1.11 fail to limit the size of a request path that includes user inputs which allows an attacker to cause excessive resource consumption, possibly leading to a DoS via sending large request paths Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://mattermost.com/security-updates
CVE ID: CVE-2024-22092 State: PUBLISHED Published: 2024-04-02T06:22:58.948Z Last Updated: 2024-08-01T22:35:34.877Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: OpenHarmony Products: OpenHarmony Problem Types: CWE-290 Description: in OpenHarmony v3.2.4 and prior versions allow a remote attacker bypass permission verification to install apps, although these require user action. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2024/2024-04.md
CVE ID: CVE-2024-22093 State: PUBLISHED Published: 2024-02-14T16:30:22.752Z Last Updated: 2025-05-02T15:34:34.574Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N) Vendors: F5 Products: BIG-IP Problem Types: CWE-77 Description: When running in appliance mode, an authenticated remote command injection vulnerability exists in an undisclosed iControl REST endpoint on multi-bladed systems. A successful exploit can allow the attacker to cross a security boundary. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://my.f5.com/manage/s/artic
ditional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://my.f5.com/manage/s/article/K000137522
CVE ID: CVE-2024-22095 State: PUBLISHED Published: 2024-05-16T20:47:00.564Z Last Updated: 2024-08-20T15:01:37.109Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H) Vendors: n/a Products: UEFI firmware for some Intel(R) Server D50DNP Family products Problem Types: escalation of privilege, CWE-20 Description: Improper input validation in PlatformVariableInitDxe driver in UEFI firmware for some Intel(R) Server D50DNP Family products may allow a privileged user to enable escalation of privilege via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-
hment: - CVE Program Container: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01080.html
CVE ID: CVE-2024-22096 State: PUBLISHED Published: 2024-02-01T23:15:06.983Z Last Updated: 2025-05-09T19:00:04.477Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Rapid Software LLC Products: Rapid SCADA Problem Types: CWE-23 Description: In Rapid Software LLC's Rapid SCADA versions prior to Version 5.8.4, an attacker can append path traversal characters to the filename when using a specific command, allowing them to read arbitrary files from the system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-011-03 - https://rapidscada.org/contact/
CVE ID: CVE-2024-22097 State: PUBLISHED Published: 2024-02-20T15:29:34.749Z Last Updated: 2025-11-04T18:23:19.915Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: The Biosig Project Products: libbiosig Problem Types: CWE-415 Description: A double-free vulnerability exists in the BrainVision Header Parsing functionality of The Biosig Project libbiosig Master Branch (ab0ee111) and 2.5.0. A specially crafted .vdhr file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_
lyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2024-1917
CVE ID: CVE-2024-22098 State: PUBLISHED Published: 2024-04-02T06:22:41.611Z Last Updated: 2024-08-01T22:35:34.823Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: OpenHarmony Products: OpenHarmony Problem Types: CWE-416 Description: in OpenHarmony v3.2.4 and prior versions allow a local attacker arbitrary code execution in any apps through use after free. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2024/2024-04.md