Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ues, read metadata, and write pull requests. In addition, the `DOCS_PREVIEW_DEPLOY_TOKEN` is exposed to the attacker. Commit 84d351e96aaa2a1338006d6e7221eded161f517b contains a fix for this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/litestar-org/litestar/security/advisories/GHSA-4hq2-rpgc-r8r7 - https://github.com/litestar-org/litestar/commit/84d351e96aaa2a1338006d6e7221eded161f517b - https://github.com/litestar-org/litestar/actions/runs/10081936962/job/27875077668#step:1:17 - https://github.com/litestar-org/litestar/blob/ffaf5616b19f6f0f4128209c8b49dbcb41568aa2/.github/workflows/docs-preview.yml
CVE ID: CVE-2024-42371 State: PUBLISHED Published: 2024-09-10T02:37:47.259Z Last Updated: 2024-09-10T14:05:07.594Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: SAP_SE Products: SAP NetWeaver Application Server for ABAP and ABAP Platform Problem Types: CWE-862 Description: The RFC enabled function module allows a low privileged user to delete the workplace favourites of any user. This vulnerability could be utilized to identify usernames and access information about targeted user's workplaces and nodes. There is low impact on integrity and availability of the application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/n
d availability of the application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3488039 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2024-42372 State: PUBLISHED Published: 2024-11-12T00:25:44.558Z Last Updated: 2024-11-12T01:35:06.199Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: SAP_SE Products: SAP NetWeaver AS Java (System Landscape Directory) Problem Types: CWE-862 Description: Due to missing authorization check in SAP NetWeaver AS Java (System Landscape Directory) an unauthorized user can read and modify some restricted global SLD configurations causing low impact on confidentiality and integrity of the application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3335394 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2024-42373 State: PUBLISHED Published: 2024-08-13T04:53:09.327Z Last Updated: 2024-08-14T16:43:46.761Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: SAP_SE Products: SAP Student Life Cycle Management (SLcM) Problem Types: CWE-862 Description: SAP Student Life Cycle Management (SLcM) fails to conduct proper authorization checks for authenticated users, leading to the potential escalation of privileges. On successful exploitation it could allow an attacker to delete non-sensitive report variants that are typically restricted, causing minimal impact on the integrity of the application. Additional Analyst Notes: - CISA ADP Vulnrichment: References:
using minimal impact on the integrity of the application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3479293 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2024-42374 State: PUBLISHED Published: 2024-08-13T03:34:11.415Z Last Updated: 2024-08-14T16:41:35.647Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H) Vendors: SAP_SE Products: SAP BEx Web Java Runtime Export Web Service Problem Types: CWE-91 Description: BEx Web Java Runtime Export Web Service does not sufficiently validate an XML document accepted from an untrusted source. An attacker can retrieve information from the SAP ADS system and exhaust the number of XMLForm service which makes the SAP ADS rendering (PDF creation) unavailable. This affects the confidentiality and availability of the application. Additional Analyst Notes: - CISA ADP Vulnrichment: R
is affects the confidentiality and availability of the application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3485284 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2024-42375 State: PUBLISHED Published: 2024-08-13T04:03:26.192Z Last Updated: 2024-12-10T06:22:12.114Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: SAP_SE Products: SAP BusinessObjects Business Intelligence Platform Problem Types: CWE-434 Description: SAP BusinessObjects Business Intelligence Platform allows an authenticated attacker to upload malicious code over the network, that could be executed by the application. On successful exploitation, the attacker can cause a low impact on the Integrity of the application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3433545 - https://me.sap.com/notes/351
al Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3433545 - https://me.sap.com/notes/3515653 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2024-42376 State: PUBLISHED Published: 2024-08-13T03:39:04.887Z Last Updated: 2024-08-13T18:15:09.197Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: SAP_SE Products: SAP Shared Service Framework Problem Types: CWE-862 Description: SAP Shared Service Framework does not perform necessary authorization check for an authenticated user, resulting in escalation of privileges. On successful exploitation, an attacker can cause a high impact on confidentiality of the application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3474590 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2024-42377 State: PUBLISHED Published: 2024-08-13T03:41:55.947Z Last Updated: 2024-08-13T18:58:02.377Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: SAP_SE Products: SAP Shared Service Framework Problem Types: CWE-862 Description: SAP shared service framework allows an authenticated non-administrative user to call a remote-enabled function, which will allow them to insert value entries into a non-sensitive table, causing low impact on integrity of the application Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3474590 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2024-42378 State: PUBLISHED Published: 2024-09-10T02:41:47.517Z Last Updated: 2024-09-10T13:38:11.796Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: SAP_SE Products: SAP S/4HANA eProcurement Problem Types: CWE-79 Description: Due to weak encoding of user-controlled inputs, eProcurement on SAP S/4HANA allows malicious scripts to be executed in the application, potentially leading to a Reflected Cross-Site Scripting (XSS) vulnerability. This has no impact on the availability of the application, but it can have some minor impact on its confidentiality and integrity. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.co
on its confidentiality and integrity. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3497347 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2024-42379 State: REJECTED Published: 2024-08-30T19:20:31.345Z Last Updated: 2024-08-30T19:23:08.594Z Description: No description available.
CVE ID: CVE-2024-42380 State: PUBLISHED Published: 2024-09-10T02:47:52.783Z Last Updated: 2024-09-10T13:37:57.456Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: SAP_SE Products: SAP NetWeaver Application Server for ABAP and ABAP Platform Problem Types: CWE-862 Description: The RFC enabled function module allows a low privileged user to read any user's workplace favourites and user menu along with all the specific data of each node. Usernames can be enumerated by exploiting vulnerability. There is low impact on confidentiality of the application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3488039 - https://url.
cation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3488039 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2024-42381 State: PUBLISHED Published: 2024-07-31T00:00:00 Last Updated: 2024-07-31T17:03:46.038Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AC:H/AV:N/A:H/C:H/I:H/PR:N/S:C/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: os/linux/elf.rb in Homebrew brew before 4.2.20 uses ldd to load ELF files obtained from untrusted sources, which allows attackers to achieve code execution via an ELF file with a custom .interp section. NOTE: this code execution would occur during an un-sandboxed binary relocation phase, which occurs before a user would expect execution of downloaded package content. (237d1e783f7ee261beaba7d3f6bde22da7148b0a was the tested vulnerable version.) Additional A
f downloaded package content. (237d1e783f7ee261beaba7d3f6bde22da7148b0a was the tested vulnerable version.) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Homebrew/brew/tree/237d1e783f7ee261beaba7d3f6bde22da7148b0a - https://github.com/trailofbits/publications/blob/master/reviews/2023-08-28-homebrew-securityreview.pdf - https://blog.trailofbits.com/2024/07/30/our-audit-of-homebrew/ - https://brew.sh/2024/07/30/homebrew-security-audit/ - https://github.com/Homebrew/brew/commit/916b37388d3851a8a93a8e9b4adc38873680ead7 - https://github.com/Homebrew/brew/releases/tag/4.2.20 - https://github.com/Homebrew/brew/pull/17136
CVE ID: CVE-2024-42383 State: PUBLISHED Published: 2024-11-18T09:04:24.283Z Last Updated: 2024-11-18T13:36:30.205Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: Cesanta Products: Mongoose Web Server Problem Types: CWE-823 Description: Use of Out-of-range Pointer Offset vulnerability in Cesanta Mongoose Web Server v7.14 allows to write a NULL byte value beyond the memory space dedicated for the hostname field. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2024-42383
CVE ID: CVE-2024-42384 State: PUBLISHED Published: 2024-11-18T09:04:46.754Z Last Updated: 2025-01-13T10:39:38.335Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Cesanta Products: Mongoose Web Server Problem Types: CWE-190 Description: Integer Overflow or Wraparound vulnerability in Cesanta Mongoose Web Server v7.14 allows an attacker to send an unexpected TLS packet and produce a segmentation fault on the application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nozominetworks.com/blog
CVE ID: CVE-2024-42385 State: PUBLISHED Published: 2024-11-18T09:05:03.540Z Last Updated: 2024-11-18T13:36:49.176Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H) Vendors: Cesanta Products: Mongoose Web Server Problem Types: CWE-140 Description: Improper Neutralization of Delimiters vulnerability in Cesanta Mongoose Web Server v7.14 allows to trigger an out-of-bound memory write if the PEM certificate contains unexpected characters. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2024-42385
CVE ID: CVE-2024-42386 State: PUBLISHED Published: 2024-11-18T09:05:27.340Z Last Updated: 2024-11-18T13:47:49.477Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H) Vendors: Cesanta Products: Mongoose Web Server Problem Types: CWE-823 Description: Use of Out-of-range Pointer Offset vulnerability in Cesanta Mongoose Web Server v7.14 allows an attacker to send an unexpected TLS packet and produce a segmentation fault on the application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2024-42386
CVE ID: CVE-2024-42387 State: PUBLISHED Published: 2024-11-18T09:06:36.620Z Last Updated: 2024-11-18T13:38:15.730Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Cesanta Products: Mongoose Web Server Problem Types: CWE-823 Description: Use of Out-of-range Pointer Offset vulnerability in Cesanta Mongoose Web Server v7.14 allows an attacker to send an unexpected TLS packet and force the application to read unintended heap memory space. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2024-42387
CVE ID: CVE-2024-42388 State: PUBLISHED Published: 2024-11-18T09:06:44.153Z Last Updated: 2024-11-18T13:37:37.168Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Cesanta Products: Mongoose Web Server Problem Types: CWE-823 Description: Use of Out-of-range Pointer Offset vulnerability in Cesanta Mongoose Web Server v7.14 allows an attacker to send an unexpected TLS packet and force the application to read unintended heap memory space. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2024-42388
CVE ID: CVE-2024-42389 State: PUBLISHED Published: 2024-11-18T09:06:51.396Z Last Updated: 2024-11-18T13:36:50.776Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Cesanta Products: Mongoose Web Server Problem Types: CWE-823 Description: Use of Out-of-range Pointer Offset vulnerability in Cesanta Mongoose Web Server v7.14 allows an attacker to send an unexpected TLS packet and force the application to read unintended heap memory space. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2024-42389
CVE ID: CVE-2024-42390 State: PUBLISHED Published: 2024-11-18T09:06:57.586Z Last Updated: 2024-11-18T13:36:09.264Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: Cesanta Products: Mongoose Web Server Problem Types: CWE-823 Description: Use of Out-of-range Pointer Offset vulnerability in Cesanta Mongoose Web Server v7.14 allows an attacker to send an unexpected TLS packet and force the application to read unintended heap memory space. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2024-42390
CVE ID: CVE-2024-42391 State: PUBLISHED Published: 2024-11-18T09:07:03.674Z Last Updated: 2024-11-18T13:35:49.668Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: Cesanta Products: Mongoose Web Server Problem Types: CWE-823 Description: Use of Out-of-range Pointer Offset vulnerability in Cesanta Mongoose Web Server v7.14 allows an attacker to send an unexpected TLS packet and force the application to read unintended heap memory space. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2024-42391
CVE ID: CVE-2024-42392 State: PUBLISHED Published: 2024-11-18T09:07:09.562Z Last Updated: 2024-11-18T13:35:30.655Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H) Vendors: Cesanta Products: Mongoose Web Server Problem Types: CWE-140 Description: Improper Neutralization of Delimiters vulnerability in Cesanta Mongoose Web Server v7.14 allows to trigger an infinite loop bug if the input string contains unexpected characters. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2024-42392
CVE ID: CVE-2024-42393 State: PUBLISHED Published: 2024-08-06T18:58:52.509Z Last Updated: 2024-08-12T16:00:36.388Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Hewlett Packard Enterprise (HPE) Products: Hpe Aruba Networking InstantOS and Aruba Access Points running ArubaOS 10 Description: There are vulnerabilities in the Soft AP Daemon Service which could allow a threat actor to execute an unauthenticated RCE attack. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system leading to complete system compromise. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hpe.com
to complete system compromise. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04678en_us&docLocale=en_US
CVE ID: CVE-2024-42394 State: PUBLISHED Published: 2024-08-06T18:57:23.377Z Last Updated: 2024-08-07T14:27:21.760Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Hewlett Packard Enterprise (HPE) Products: HPE Aruba Networking InstantOS and Aruba Access Points running ArubaOS 10 Description: There are vulnerabilities in the Soft AP Daemon Service which could allow a threat actor to execute an unauthenticated RCE attack. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system leading to complete system compromise. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hpe.com
CVE ID: CVE-2024-42395 State: PUBLISHED Published: 2024-08-06T18:56:05.348Z Last Updated: 2024-08-08T14:47:07.721Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Hewlett Packard Enterprise (HPE) Products: HPE Aruba Networking InstantOS and Aruba Access Points running ArubaOS 10 Description: There is a vulnerability in the AP Certificate Management Service which could allow a threat actor to execute an unauthenticated RCE attack. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system leading to complete system compromise. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://suppo
em leading to complete system compromise. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04678en_us&docLocale=en_US
CVE ID: CVE-2024-42396 State: PUBLISHED Published: 2024-08-06T18:54:42.859Z Last Updated: 2025-03-25T16:46:21.354Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Hewlett Packard Enterprise (HPE) Products: HPE Aruba Networking InstantOS and Aruba Access Points running ArubaOS 10 Description: Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the AP Certificate Management daemon accessed via the PAPI protocol. Successful exploitation of these vulnerabilities results in the ability to interrupt the normal operation of the affected Access Point. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpesc
he affected Access Point. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04678en_us&docLocale=en_US
CVE ID: CVE-2024-42397 State: PUBLISHED Published: 2024-08-06T18:51:57.643Z Last Updated: 2025-03-19T16:03:44.141Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Hewlett Packard Enterprise (HPE) Products: HPE Aruba Networking InstantOS and Aruba Access Points running ArubaOS 10 Description: Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the AP Certificate Management daemon accessed via the PAPI protocol. Successful exploitation of these vulnerabilities results in the ability to interrupt the normal operation of the affected Access Point. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpesc
CVE ID: CVE-2024-42398 State: PUBLISHED Published: 2024-08-06T19:37:12.816Z Last Updated: 2025-03-24T21:04:59.030Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Hewlett Packard Enterprise Products: HPE Aruba Networking InstantOS and Aruba Access Points running ArubaOS 10 Description: Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the Soft AP daemon accessed via the PAPI protocol. Successful exploitation of these vulnerabilities results in the ability to interrupt the normal operation of the affected Access Point. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpesc/public/docDisplay?docId
. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04678en_us&docLocale=en_US
CVE ID: CVE-2024-42399 State: PUBLISHED Published: 2024-08-06T19:48:07.255Z Last Updated: 2025-03-13T13:37:13.997Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Hewlett Packard Enterprise Products: HPE Aruba Networking InstantOS and Aruba Access Points running ArubaOS 10 Description: Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the Soft AP daemon accessed via the PAPI protocol. Successful exploitation of these vulnerabilities results in the ability to interrupt the normal operation of the affected Access Point. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpesc/public/docDisplay?docId
CVE ID: CVE-2024-42400 State: PUBLISHED Published: 2024-08-06T19:51:17.264Z Last Updated: 2025-03-13T17:20:31.058Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Hewlett Packard Enterprise Products: HPE Aruba Networking InstantOS and Aruba Access Points running ArubaOS 10 Description: Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the Soft AP daemon accessed via the PAPI protocol. Successful exploitation of these vulnerabilities results in the ability to interrupt the normal operation of the affected Access Point. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpesc/public/docDisplay?docId
CVE ID: CVE-2024-42404 State: PUBLISHED Published: 2024-09-18T05:20:30.045Z Last Updated: 2024-09-18T15:19:17.953Z Vendors: Welcart Inc. Products: Welcart e-Commerce Problem Types: Improper neutralization of special elements used in an SQL command ('SQL Injection') Description: SQL injection vulnerability in Welcart e-Commerce prior to 2.11.2 allows an attacker who can login to the product to obtain or alter the information stored in the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.welcart.com/archives/22581.html - https://jvn.jp/en/jp/JVN19766555/
CVE ID: CVE-2024-42405 State: PUBLISHED Published: 2025-02-12T21:19:57.317Z Last Updated: 2025-02-18T17:31:01.017Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) Quartus(R) Prime Software Problem Types: Escalation of Privilege, CWE-427 Description: Uncontrolled search path for some Intel(R) Quartus(R) Prime Software before version 23.1.1 Patch 1.01std may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01231.html
CVE ID: CVE-2024-42406 State: PUBLISHED Published: 2024-09-26T08:04:22.939Z Last Updated: 2024-09-26T13:11:34.682Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: Mattermost Products: Mattermost Problem Types: CWE-284 Description: Mattermost versions 9.11.x <= 9.11.0, 9.10.x <= 9.10.1, 9.9.x <= 9.9.2 and 9.5.x <= 9.5.8 fail to properly authorize requests when viewing archived channels is disabled, which allows an attacker to retrieve post and file information about archived channels. Examples are flagged or unread posts as well as files. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2024-42407 State: PUBLISHED Published: 2024-12-12T01:36:12.364Z Last Updated: 2024-12-12T15:18:01.369Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N) Vendors: Gallagher Products: Command Centre Server Problem Types: CWE-532 Description: Insertion of Sensitive Information into Log File (CWE-532) in the Gallagher Command Centre Alarm Transmitter feature could allow an authenticated Operator to view some security sensitive information to which they have not been granted access. This issue affects: Command Centre Server 9.10 prior to 9.10.2149 (MR4), 9.00 prior to 9.00.2374 (MR5), 8.90 prior to 8.90.2356 (MR6), all versions of 8.80 and prior. Additional Analys