Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-29825 State: PUBLISHED Published: 2024-05-31T17:38:31.330Z Last Updated: 2024-08-02T01:17:57.543Z Severity: CRITICAL (CVSS 9.6 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Ivanti Products: EPM Description: An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execute arbitrary code. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://forums.ivanti.com/s/article/Security-Advisory-May-2024
CVE ID: CVE-2024-29826 State: PUBLISHED Published: 2024-05-31T17:38:31.399Z Last Updated: 2024-08-02T01:17:58.045Z Severity: CRITICAL (CVSS 9.6 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Ivanti Products: EPM Description: An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execute arbitrary code. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://forums.ivanti.com/s/article/Security-Advisory-May-2024
CVE ID: CVE-2024-29827 State: PUBLISHED Published: 2024-05-31T17:38:31.405Z Last Updated: 2024-08-02T01:17:57.542Z Severity: CRITICAL (CVSS 9.6 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Ivanti Products: EPM Description: An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execute arbitrary code. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://forums.ivanti.com/s/article/Security-Advisory-May-2024
CVE ID: CVE-2024-29828 State: PUBLISHED Published: 2024-05-31T17:38:31.394Z Last Updated: 2024-08-02T01:17:57.504Z Severity: HIGH (CVSS 8.4 CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Ivanti Products: EPM Description: An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an authenticated attacker within the same network to execute arbitrary code. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://forums.ivanti.com/s/article/Security-Advisory-May-2024
CVE ID: CVE-2024-29829 State: PUBLISHED Published: 2024-05-31T17:38:31.379Z Last Updated: 2024-08-02T01:17:58.030Z Severity: HIGH (CVSS 8.4 CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Ivanti Products: EPM Description: An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an authenticated attacker within the same network to execute arbitrary code. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://forums.ivanti.com/s/article/Security-Advisory-May-2024
CVE ID: CVE-2024-29830 State: PUBLISHED Published: 2024-05-31T17:38:31.352Z Last Updated: 2024-08-02T01:17:57.943Z Severity: HIGH (CVSS 8.4 CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Ivanti Products: EPM Description: An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an authenticated attacker within the same network to execute arbitrary code. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://forums.ivanti.com/s/article/Security-Advisory-May-2024
CVE ID: CVE-2024-29831 State: PUBLISHED Published: 2024-08-09T14:21:48.184Z Last Updated: 2024-08-12T17:49:00.242Z Vendors: Apache Software Foundation Products: Apache DolphinScheduler Problem Types: CWE-20 Description: Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed javascript to be executed on the server. If you are using the switch task plugin, please upgrade to version 3.2.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/x1ch0x5om3srtbnp7rtsvdszho3mdrq0
CVE ID: CVE-2024-29832 State: PUBLISHED Published: 2024-03-26T15:24:24.084Z Last Updated: 2024-08-02T16:41:57.722Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: 10Web Products: PhotoGallery Problem Types: CWE-79 Description: The current_url parameter of the AJAX call to the GalleryBox action of admin-ajax.php is vulnerable to reflected Cross Site Scripting. The value of the current_url parameter is embedded within an existing JavaScript within the response allowing arbitrary JavaScript to be inserted and executed. No authentication is required to exploit this issue. Note that other parameters within a AJAX call, such as image_id, must be valid for this vul
uired to exploit this issue. Note that other parameters within a AJAX call, such as image_id, must be valid for this vulnerability to be successfully exploited. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://appcheck-ng.com/xss-vulnerabilities-discovered-10web-photogallery-wordpress-plugin/ - https://wordpress.org/plugins/photo-gallery/#developers
CVE ID: CVE-2024-29833 State: PUBLISHED Published: 2024-03-26T15:30:28.269Z Last Updated: 2024-08-02T16:46:09.578Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: 10Web Products: PhotoGallery Problem Types: CWE-79 Description: The image upload component allows SVG files and the regular expression used to remove script tags can be bypassed by using a Cross Site Scripting payload which does not match the regular expression; one example of this is the inclusion of whitespace within the script tag. An attacker must target an authenticated user with permissions to access this feature, however once uploaded the payload is also accessible to unauthenticated users.
with permissions to access this feature, however once uploaded the payload is also accessible to unauthenticated users. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://appcheck-ng.com/xss-vulnerabilities-discovered-10web-photogallery-wordpress-plugin/ - https://wordpress.org/plugins/photo-gallery/#developers
CVE ID: CVE-2024-29834 State: PUBLISHED Published: 2024-04-02T19:24:46.473Z Last Updated: 2025-02-13T17:47:43.136Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: Apache Software Foundation Products: Apache Pulsar Problem Types: CWE-863 Description: This vulnerability allows authenticated users with produce or consume permissions to perform unauthorized operations on partitioned topics, such as unloading topics and triggering compaction. These management operations should be restricted to users with the tenant admin role or superuser role. An authenticated user with produce permission can create subscriptions and update subscription properties on partitioned
An authenticated user with produce permission can create subscriptions and update subscription properties on partitioned topics, even though this should be limited to users with consume permissions. This impact analysis assumes that Pulsar has been configured with the default authorization provider. For custom authorization providers, the impact could be slightly different. Additionally, the vulnerability allows an authenticated user to read, create, modify, and delete namespace properties in any namespace in any tenant. In Pulsar, namespace properties are reserved for user provided metadata about the namespace. This issue affects Apache Pulsar versions from 2.7.1 to 2.10.6, from 2.11.0 to 2
provided metadata about the namespace. This issue affects Apache Pulsar versions from 2.7.1 to 2.10.6, from 2.11.0 to 2.11.4, from 3.0.0 to 3.0.3, from 3.1.0 to 3.1.3, and from 3.2.0 to 3.2.1. 3.0 Apache Pulsar users should upgrade to at least 3.0.4. 3.1 and 3.2 Apache Pulsar users should upgrade to at least 3.2.2. Users operating versions prior to those listed above should upgrade to the aforementioned patched versions or newer versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://pulsar.apache.org/security/CVE-2024-29834/ - https://lists.apache.org/thread/v0ltl94k9lg28qfr1f54hpkvvsjc5bj5 - http://www.openwall.com/lists/oss-security/202
834/ - https://lists.apache.org/thread/v0ltl94k9lg28qfr1f54hpkvvsjc5bj5 - http://www.openwall.com/lists/oss-security/2024/04/02/2
CVE ID: CVE-2024-29836 State: PUBLISHED Published: 2024-04-14T23:47:13.849Z Last Updated: 2024-08-02T01:17:57.373Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: CS Technologies Australia Products: Evolution Controller Problem Types: CWE-284 Description: The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below contains poorly configured access control, allowing for an unauthenticated attacker to update and add user profiles within the application, and gain full access of the site. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://directcyber.com.au/sa/CVE-2024-29836-to-29844-evolution
ADP Vulnrichment: - CVE Program Container: References: - https://directcyber.com.au/sa/CVE-2024-29836-to-29844-evolution-controller-multiple-vulnerabilities.html
CVE ID: CVE-2024-29837 State: PUBLISHED Published: 2024-04-14T23:47:48.598Z Last Updated: 2024-08-02T01:17:57.361Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: CS Technologies Australia Products: Evolution Controller Problem Types: CWE-284, CWE-1390 Description: The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below uses poor session management, allowing for an unauthenticated attacker to access administrator functionality if any other user is already signed in. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://directcyber.com.au/sa/CVE-2024-29836-to-29844-evolution-controller-multipl
CVE Program Container: References: - https://directcyber.com.au/sa/CVE-2024-29836-to-29844-evolution-controller-multiple-vulnerabilities.html
CVE ID: CVE-2024-29838 State: PUBLISHED Published: 2024-04-14T23:47:53.652Z Last Updated: 2024-08-02T01:17:57.930Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: CS Technologies Australia Products: Evolution Controller Problem Types: CWE-457, CWE-20 Description: The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below does not proper sanitize user input, allowing for an unauthenticated attacker to crash the controller software Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://directcyber.com.au/sa/CVE-2024-29836-to-29844-evolution-controller-multiple-vulnerabilities.html
CVE ID: CVE-2024-29839 State: PUBLISHED Published: 2024-04-14T23:48:00.923Z Last Updated: 2024-08-02T01:17:57.614Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: CS Technologies Australia Products: Evolution Controller Problem Types: CWE-200, CWE-284 Description: The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below contains poorly configured access control on DESKTOP_EDIT_USER_GET_CARD, allowing for an unauthenticated attacker to return the card value data of any user Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://directcyber.com.au/sa/CVE-2024-29836-to-29844-evolution-controller-m
ent: - CVE Program Container: References: - https://directcyber.com.au/sa/CVE-2024-29836-to-29844-evolution-controller-multiple-vulnerabilities.html
CVE ID: CVE-2024-29840 State: PUBLISHED Published: 2024-04-14T23:48:05.450Z Last Updated: 2024-08-02T01:17:58.069Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: CS Technologies Australia Products: Evolution Controller Problem Types: CWE-200, CWE-284 Description: The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below contains poorly configured access control on DESKTOP_EDIT_USER_GET_PIN_FIELDS, allowing for an unauthenticated attacker to return the pin value of any user Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://directcyber.com.au/sa/CVE-2024-29836-to-29844-evolution-controller-m
CVE ID: CVE-2024-29841 State: PUBLISHED Published: 2024-04-14T23:48:12.171Z Last Updated: 2024-08-02T01:17:58.164Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: CS Technologies Australia Products: Evolution Controller Problem Types: CWE-200, CWE-284 Description: The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below contains poorly configured access control on DESKTOP_EDIT_USER_GET_KEYS_FIELDS, allowing for an unauthenticated attacker to return the keys value of any user Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://directcyber.com.au/sa/CVE-2024-29836-to-29844-evolution-controller
hment: - CVE Program Container: References: - https://directcyber.com.au/sa/CVE-2024-29836-to-29844-evolution-controller-multiple-vulnerabilities.html
CVE ID: CVE-2024-29842 State: PUBLISHED Published: 2024-04-14T23:48:17.195Z Last Updated: 2024-08-02T01:17:57.926Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: CS Technologies Australia Products: Evolution Controller Problem Types: CWE-200, CWE-284 Description: The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below contains poorly configured access control on DESKTOP_EDIT_USER_GET_ABACARD_FIELDS, allowing for an unauthenticated attacker to return the abacard field of any user Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://directcyber.com.au/sa/CVE-2024-29836-to-29844-evolution-cont
ulnrichment: - CVE Program Container: References: - https://directcyber.com.au/sa/CVE-2024-29836-to-29844-evolution-controller-multiple-vulnerabilities.html
CVE ID: CVE-2024-29843 State: PUBLISHED Published: 2024-04-14T23:48:21.656Z Last Updated: 2024-08-02T01:17:57.993Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: CS Technologies Australia Products: Evolution Controller Problem Types: CWE-200, CWE-284 Description: The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below contains poorly configured access control on MOBILE_GET_USERS_LIST, allowing for an unauthenticated attacker to enumerate all users and their access levels Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://directcyber.com.au/sa/CVE-2024-29836-to-29844-evolution-controller-m
CVE ID: CVE-2024-29844 State: PUBLISHED Published: 2024-04-14T23:48:26.802Z Last Updated: 2024-09-25T22:37:13.799Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: CS Technologies Australia Products: Evolution Controller Problem Types: CWE-1392 Description: Default credentials on the Web Interface of Evolution Controller 2.x allows anyone to log in to the server directly to perform administrative functions. Upon installation or upon first login, the application does not ask the user to change the password. There is no warning or prompt to ask the user to change the default password. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container:
ask the user to change the default password. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://directcyber.com.au/sa/CVE-2024-29836-to-29844-evolution-controller-multiple-vulnerabilities.html
CVE ID: CVE-2024-29846 State: PUBLISHED Published: 2024-05-31T17:38:31.371Z Last Updated: 2024-08-02T01:17:58.190Z Severity: HIGH (CVSS 8.4 CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Ivanti Products: EPM Description: An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an authenticated attacker within the same network to execute arbitrary code. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ivanti.com/blog/topics/security-advisory
CVE ID: CVE-2024-29847 State: PUBLISHED Published: 2024-09-12T01:09:56.277Z Last Updated: 2024-09-17T03:55:12.223Z Severity: CRITICAL (CVSS 10 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Ivanti Products: EPM Description: Deserialization of untrusted data in the agent portal of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to achieve remote code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-EPM-September-2024-for-EPM-2024-and-EPM-2022
CVE ID: CVE-2024-29848 State: PUBLISHED Published: 2024-05-31T17:38:31.376Z Last Updated: 2024-09-19T05:08:34.779Z Severity: HIGH (CVSS 7.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Ivanti Products: Avalanche Description: An unrestricted file upload vulnerability in web component of Ivanti Avalanche before 6.4.x allows an authenticated, privileged user to execute arbitrary commands as SYSTEM. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://forums.ivanti.com/s/article/Security-Advisory-May-2024
CVE ID: CVE-2024-29849 State: PUBLISHED Published: 2024-05-22T22:55:11.237Z Last Updated: 2024-09-19T01:38:17.699Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Veeam Products: Backup & Replication Description: Veeam Backup Enterprise Manager allows unauthenticated users to log in as any user to enterprise manager web interface. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://veeam.com/kb4581
CVE ID: CVE-2024-29850 State: PUBLISHED Published: 2024-05-22T22:55:11.260Z Last Updated: 2024-09-19T01:50:51.392Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Veeam Products: Backup & Replication Description: Veeam Backup Enterprise Manager allows account takeover via NTLM relay. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://veeam.com/kb4581
CVE ID: CVE-2024-29851 State: PUBLISHED Published: 2024-05-22T22:55:11.273Z Last Updated: 2024-09-19T01:50:16.524Z Severity: HIGH (CVSS 7.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Veeam Products: Backup & Replication Description: Veeam Backup Enterprise Manager allows high-privileged users to steal NTLM hash of Enterprise manager service account. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://veeam.com/kb4581
CVE ID: CVE-2024-29852 State: PUBLISHED Published: 2024-05-22T22:55:11.272Z Last Updated: 2024-09-19T01:58:15.369Z Severity: LOW (CVSS 2.7 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N) Vendors: Veeam Products: Backup & Replication Description: Veeam Backup Enterprise Manager allows high-privileged users to read backup session logs. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://veeam.com/kb4581
CVE ID: CVE-2024-29853 State: PUBLISHED Published: 2024-05-22T22:55:11.273Z Last Updated: 2024-12-04T15:20:00.977Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Veeam Products: Agent for Windows Description: An authentication bypass vulnerability in Veeam Agent for Microsoft Windows allows for local privilege escalation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://veeam.com/kb4582
CVE ID: CVE-2024-29855 State: PUBLISHED Published: 2024-06-11T03:55:54.458Z Last Updated: 2025-03-27T21:09:44.177Z Severity: CRITICAL (CVSS 9 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Veeam Products: Recovery Orchestrator Description: Hard-coded JWT secret allows authentication bypass in Veeam Recovery Orchestrator Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.veeam.com/kb4585
CVE ID: CVE-2024-29857 State: PUBLISHED Published: 2024-05-09T04:17:29.645Z Last Updated: 2025-02-13T15:47:48.325Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in ECCurve.java and ECCurve.cs in Bouncy Castle Java (BC Java) before 1.78, BC Java LTS before 2.73.6, BC-FJA before 1.0.2.5, and BC C# .Net before 2.3.1. Importing an EC certificate with crafted F2m parameters can lead to excessive CPU consumption during the evaluation of the curve parameters. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.bouncycastle.org/latest_releases.html - https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902024%E2%80%902
: - https://www.bouncycastle.org/latest_releases.html - https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902024%E2%80%9029857 - https://github.com/bcgit/bc-csharp/wiki/CVE%E2%80%902024%E2%80%9029857
CVE ID: CVE-2024-29858 State: PUBLISHED Published: 2024-03-21T00:00:00 Last Updated: 2024-08-05T19:16:20.315Z Vendors: n/a Products: n/a Problem Types: n/a Description: In MISP before 2.4.187, __uploadLogo in app/Controller/OrganisationsController.php does not properly check for a valid logo upload. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/MISP/MISP/commit/6a2986be6aad6b37858b4869e238f517b295c111
CVE ID: CVE-2024-29859 State: PUBLISHED Published: 2024-03-21T00:00:00 Last Updated: 2024-08-05T16:48:17.848Z Vendors: n/a Products: n/a Problem Types: n/a Description: In MISP before 2.4.187, add_misp_export in app/Controller/EventsController.php does not properly check for a valid file upload. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/MISP/MISP/commit/238010bfd004680757b324cba0c6344f77a25399
CVE ID: CVE-2024-29862 State: PUBLISHED Published: 2024-03-21T00:00:00 Last Updated: 2024-11-05T18:49:11.461Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Kerlink firewall in ChirpStack chirpstack-mqtt-forwarder before 4.2.1 and chirpstack-gateway-bridge before 4.0.11 wrongly accepts certain TCP packets when a connection is not in the ESTABLISHED state. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/chirpstack/chirpstack-mqtt-forwarder/commit/4fa9e6eaaec8c3ca49ebfbf6317572671f17700f - https://github.com/chirpstack/chirpstack-gateway-bridge/commit/0c1e80c9fa9f5d093ff62903caedad86ec4640b6
CVE ID: CVE-2024-29863 State: PUBLISHED Published: 2024-04-05T00:00:00 Last Updated: 2024-09-06T19:09:13.686Z Vendors: n/a Products: n/a Problem Types: n/a Description: A race condition in the installer executable in Qlik Qlikview before versions May 2022 SR3 (12.70.20300) and May 2023 SR2 (12,80.20200) may allow an existing lower privileged user to cause code to be executed in the context of a Windows Administrator. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://community.qlik.com/t5/Official-Support-Articles/High-Severity-Security-fix-for-QlikView-CVE-2024-29863/ta-p/2432661
CVE ID: CVE-2024-29864 State: PUBLISHED Published: 2024-03-21T00:00:00 Last Updated: 2024-09-04T17:28:18.935Z Vendors: n/a Products: n/a Problem Types: n/a Description: Distrobox before 1.7.0.1 allows attackers to execute arbitrary code via command injection into exported executables. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/89luca89/distrobox/commit/82a69f0a234e73e447d0ea8c8b3443b84fd31944 - https://github.com/89luca89/distrobox/issues/1275
CVE ID: CVE-2024-29865 State: PUBLISHED Published: 2024-03-22T00:00:00.000Z Last Updated: 2025-03-28T23:49:23.862Z Vendors: n/a Products: n/a Problem Types: n/a Description: Logpoint before 7.1.0 allows Self-XSS on the LDAP authentication page via the username to the LDAP login form. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://servicedesk.logpoint.com/hc/en-us/articles/17710372214045-Self-XSS-on-LDAP-authentication