Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-24880 State: PUBLISHED Published: 2024-02-08T11:58:20.855Z Last Updated: 2024-08-01T23:28:12.875Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Apollo13Themes Products: Apollo13 Framework Extensions Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apollo13Themes Apollo13 Framework Extensions allows Stored XSS.This issue affects Apollo13 Framework Extensions: from n/a through 1.9.2. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/apollo13-framework-extensions/wordpres
VE Program Container: References: - https://patchstack.com/database/vulnerability/apollo13-framework-extensions/wordpress-apollo13-framework-extensions-plugin-1-9-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-24881 State: PUBLISHED Published: 2024-02-08T11:19:21.541Z Last Updated: 2024-08-01T23:28:12.857Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: VeronaLabs Products: WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VeronaLabs WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc allows Reflected XSS.This issue affects WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc: from n/a through 6.5.2. Additional Analyst
Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc: from n/a through 6.5.2. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/wp-sms/wordpress-wp-sms-plugin-6-5-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-24882 State: PUBLISHED Published: 2024-05-17T08:48:42.875Z Last Updated: 2024-08-01T23:28:12.959Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Masteriyo Products: LMS Problem Types: CWE-269 Description: Improper Privilege Management vulnerability in Masteriyo LMS allows Privilege Escalation.This issue affects LMS: from n/a through 1.7.2. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/learning-management-system/wordpress-lms-by-masteriyo-plugin-1-7-2-privilege-escalation-vulnerability?_s_id=cve
CVE ID: CVE-2024-24883 State: PUBLISHED Published: 2024-03-21T17:55:39.361Z Last Updated: 2024-08-09T20:13:59.196Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: BdThemes Products: Prime Slider – Addons For Elementor Problem Types: CWE-862 Description: Missing Authorization vulnerability in BdThemes Prime Slider – Addons For Elementor.This issue affects Prime Slider – Addons For Elementor: from n/a through 3.11.10. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/bdthemes-prime-slider-lite/wordpress-prime-slider-plugin-3-11-10-broken-access-control-on-duplicate-post-vulne
erability/bdthemes-prime-slider-lite/wordpress-prime-slider-plugin-3-11-10-broken-access-control-on-duplicate-post-vulnerability?_s_id=cve
CVE ID: CVE-2024-24884 State: PUBLISHED Published: 2024-02-12T08:46:54.954Z Last Updated: 2025-04-24T15:43:59.249Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: ARI Soft Products: Contact Form 7 Connector Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in ARI Soft Contact Form 7 Connector.This issue affects Contact Form 7 Connector: from n/a through 1.2.2. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/ari-cf7-connector/wordpress-contact-form-7-connector-plugin-1-2-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2024-24885 State: PUBLISHED Published: 2024-02-08T11:16:48.664Z Last Updated: 2024-08-01T23:28:12.871Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Lê Văn Toản Products: Woocommerce Vietnam Checkout Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Lê Văn Toản Woocommerce Vietnam Checkout allows Stored XSS.This issue affects Woocommerce Vietnam Checkout: from n/a through 2.0.7. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/woo-vietnam-checkout/wordpress-woocommerce-viet
m Container: References: - https://patchstack.com/database/vulnerability/woo-vietnam-checkout/wordpress-woocommerce-vietnam-checkout-plugin-2-0-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-24886 State: PUBLISHED Published: 2024-02-08T10:46:28.400Z Last Updated: 2024-08-01T23:28:12.886Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Acowebs Products: Product Labels For Woocommerce (Sale Badges) Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Acowebs Product Labels For Woocommerce (Sale Badges) allows Stored XSS.This issue affects Product Labels For Woocommerce (Sale Badges): from n/a through 1.5.3. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/aco-pro
s: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/aco-product-labels-for-woocommerce/wordpress-product-labels-for-woocommerce-sale-badges-plugin-1-5-3-authenticated-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-24887 State: PUBLISHED Published: 2024-02-12T08:43:26.923Z Last Updated: 2024-08-01T23:28:12.933Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: Contest Gallery Products: Photos and Files Contest Gallery – Contact Form, Upload Form, Social Share and Voting Plugin for WordPress Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Contest Gallery Photos and Files Contest Gallery – Contact Form, Upload Form, Social Share and Voting Plugin for WordPress.This issue affects Photos and Files Contest Gallery – Contact Form, Upload Form, Social Share and Voting Plugin for WordPress: from n/a through 21.2.8.4. Additi
est Gallery – Contact Form, Upload Form, Social Share and Voting Plugin for WordPress: from n/a through 21.2.8.4. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/contest-gallery/wordpress-photos-and-files-contest-gallery-plugin-21-2-8-4-csrf-leading-to-gallery-creation-vulnerability?_s_id=cve
CVE ID: CVE-2024-24888 State: PUBLISHED Published: 2024-04-02T18:16:34.469Z Last Updated: 2024-08-08T19:15:47.938Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: Kadence WP Products: Gutenberg Blocks by Kadence Blocks Problem Types: CWE-918 Description: Server-Side Request Forgery (SSRF) vulnerability in Kadence WP Gutenberg Blocks by Kadence Blocks.This issue affects Gutenberg Blocks by Kadence Blocks: from n/a through 3.2.25. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/kadence-blocks/wordpress-gutenberg-blocks-by-kadence-blocks-plugin-3-2-25-server-side-request-for
database/vulnerability/kadence-blocks/wordpress-gutenberg-blocks-by-kadence-blocks-plugin-3-2-25-server-side-request-forgery-ssrf-vulnerability?_s_id=cve
CVE ID: CVE-2024-24889 State: PUBLISHED Published: 2024-02-12T06:12:33.034Z Last Updated: 2024-08-01T23:28:12.977Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Geek Code Lab Products: All 404 Pages Redirect to Homepage Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Geek Code Lab All 404 Pages Redirect to Homepage allows Stored XSS.This issue affects All 404 Pages Redirect to Homepage: from n/a through 1.9. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/all-404-pages-redirect-to-h
chment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/all-404-pages-redirect-to-homepage/wordpress-all-404-pages-redirect-to-homepage-plugin-1-9-unauthenticated-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-24890 State: PUBLISHED Published: 2024-03-25T07:09:25.879Z Last Updated: 2024-08-12T18:44:27.814Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: openEuler Products: gala-gopher Problem Types: CWE-78 Description: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in openEuler gala-gopher on Linux allows Command Injection. This vulnerability is associated with program files https://gitee.Com/openeuler/gala-gopher/blob/master/src/probes/extends/ebpf.Probe/src/ioprobe/ioprobe.C. This issue affects gala-gopher: through 1.0.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnric
.C. This issue affects gala-gopher: through 1.0.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-1278 - https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-1279 - https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-1277 - https://gitee.com/src-openeuler/gala-gopher/pulls/81 - https://gitee.com/src-openeuler/gala-gopher/pulls/85 - https://gitee.com/src-openeuler/gala-gopher/pulls/82
CVE ID: CVE-2024-24891 State: PUBLISHED Published: 2024-04-15T12:03:40.643Z Last Updated: 2024-08-20T17:41:19.874Z Severity: MEDIUM (CVSS 6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N) Vendors: openEuler Products: kernel Problem Types: CWE-200 Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in openEuler kernel on Linux allows Resource Leak Exposure. This vulnerability is associated with program files https://gitee.Com/openeuler/kernel/blob/openEuler-1.0-LTS/drivers/staging/gmjstcm/tcm.C. This issue affects kernel: from 4.19.90-2109.1.0.0108 before 4.19.90-2403.4.0.0244. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Referenc
.0108 before 4.19.90-2403.4.0.0244. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-1358 - https://gitee.com/openeuler/kernel/pulls/2810 - https://gitee.com/src-openeuler/kernel/pulls/1321 - https://gitee.com/src-openeuler/kernel/pulls/1320 - https://gitee.com/src-openeuler/kernel/pulls/1322
CVE ID: CVE-2024-24892 State: PUBLISHED Published: 2024-03-25T07:13:46.510Z Last Updated: 2024-08-01T23:28:12.928Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: openEuler Products: migration-tools Problem Types: CWE-78, CWE-269 Description: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), Improper Privilege Management vulnerability in openEuler migration-tools on Linux allows Command Injection, Restful Privilege Elevation. This vulnerability is associated with program files https://gitee.Com/openeuler/migration-tools/blob/master/index.Py. This issue affects migration-tools: from 1.0.0 through 1.0.1. Additional Analy
ler/migration-tools/blob/master/index.Py. This issue affects migration-tools: from 1.0.0 through 1.0.1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-1275 - https://gitee.com/src-openeuler/migration-tools/pulls/12
CVE ID: CVE-2024-24897 State: PUBLISHED Published: 2024-03-25T07:10:48.934Z Last Updated: 2024-08-12T18:46:09.906Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: openEuler Products: A-Tune-Collector Problem Types: CWE-77 Description: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in openEuler A-Tune-Collector on Linux allows Command Injection. This vulnerability is associated with program files https://gitee.Com/openeuler/A-Tune-Collector/blob/master/atune_collector/plugin/monitor/process/sched.Py. This issue affects A-Tune-Collector: from 1.1.0-3 through 1.3.0. Additional Analyst Notes: - CVE Program Contain
hed.Py. This issue affects A-Tune-Collector: from 1.1.0-3 through 1.3.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-1273 - https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-1271 - https://gitee.com/src-openeuler/A-Tune-Collector/pulls/45 - https://gitee.com/src-openeuler/A-Tune-Collector/pulls/47
CVE ID: CVE-2024-24898 State: PUBLISHED Published: 2024-04-15T12:04:31.270Z Last Updated: 2024-08-01T23:28:12.928Z Severity: MEDIUM (CVSS 6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N) Vendors: openEuler Products: kernel Problem Types: CWE-200 Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in openEuler kernel on Linux allows Resource Leak Exposure. This vulnerability is associated with program files https://gitee.Com/openeuler/kernel/blob/openEuler-1.0-LTS/drivers/staging/gmjstcm/tcm.C. This issue affects kernel: from 4.19.90-2109.1.0.0108 before 4.19.90-2403.4.0.0244. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: Referenc
.0108 before 4.19.90-2403.4.0.0244. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-1358 - https://gitee.com/src-openeuler/kernel/pulls/1321 - https://gitee.com/src-openeuler/kernel/pulls/1320 - https://gitee.com/src-openeuler/kernel/pulls/1322
CVE ID: CVE-2024-24899 State: PUBLISHED Published: 2024-03-25T07:13:13.251Z Last Updated: 2024-08-12T18:43:05.811Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: openEuler Products: aops-zeus Problem Types: CWE-78 Description: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in openEuler aops-zeus on Linux allows Command Injection. This vulnerability is associated with program files https://gitee.Com/openeuler/aops-zeus/blob/master/zeus/conf/constant.Py. This issue affects aops-zeus: from 1.2.0 through 1.4.0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https:
om 1.2.0 through 1.4.0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-1292 - https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-1293 - https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-1294 - https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-1291 - https://gitee.com/src-openeuler/aops-zeus/pulls/108 - https://gitee.com/src-openeuler/aops-zeus/pulls/107
CVE ID: CVE-2024-24900 State: PUBLISHED Published: 2024-03-01T13:00:00.943Z Last Updated: 2024-08-08T18:40:29.983Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N) Vendors: Dell Products: Secure Connect Gateway (SCG) Policy Manager Problem Types: CWE-285 Description: Dell Secure Connect Gateway (SCG) Policy Manager, all versions, contain an improper authorization vulnerability. An adjacent network low privileged attacker could potentially exploit this vulnerability, leading to unauthorized devices added to policies. Exploitation may lead to information disclosure and unauthorized access to the system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnr
on disclosure and unauthorized access to the system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000222330/dsa-2024-077-security-update-for-dell-secure-connect-gateway-policy-manager-vulnerabilities
CVE ID: CVE-2024-24901 State: PUBLISHED Published: 2024-03-04T13:23:28.629Z Last Updated: 2024-08-12T13:57:52.556Z Severity: LOW (CVSS 3 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:L) Vendors: Dell Products: PowerScale OneFS Problem Types: CWE-778 Description: Dell PowerScale OneFS 8.2.x through 9.6.0.x contain an insufficient logging vulnerability. A local malicious user with high privileges could potentially exploit this vulnerability, causing audit messages lost and not recorded for a specific time period. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000222691/dsa-2024-062-security-update-for-dell-powersc
richment: References: - https://www.dell.com/support/kbdoc/en-us/000222691/dsa-2024-062-security-update-for-dell-powerscale-onefs-for-proprietary-code-vulnerabilities
CVE ID: CVE-2024-24902 State: PUBLISHED Published: 2024-12-13T14:11:04.854Z Last Updated: 2024-12-13T20:38:37.546Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L) Vendors: Dell Products: RecoverPoint for Virtual Machines Problem Types: CWE-284 Description: Dell RecoverPoint for Virtual Machines 6.0.x contains an Improper access control vulnerability. A low privileged local attacker could potentially exploit this vulnerability leading to gaining access to unauthorized data for a limited time. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000259765/dsa-2024-429-security-update-for-dell-recoverpoint-for-virtual
ces: - https://www.dell.com/support/kbdoc/en-us/000259765/dsa-2024-429-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities
CVE ID: CVE-2024-24903 State: PUBLISHED Published: 2024-03-01T13:30:30.579Z Last Updated: 2024-08-05T18:42:07.112Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Dell Products: Secure Connect Gateway (SCG) Policy Manager Problem Types: CWE-640 Description: Dell Secure Connect Gateway (SCG) Policy Manager, version 5.10+, contain a weak password recovery mechanism for forgotten passwords. An adjacent network low privileged attacker could potentially exploit this vulnerability, leading to unauthorized access to the application with privileges of the compromised account. The attacker could retrieve the reset password token without authorization and then perform the
the compromised account. The attacker could retrieve the reset password token without authorization and then perform the password change. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000222330/dsa-2024-077-security-update-for-dell-secure-connect-gateway-policy-manager-vulnerabilities
CVE ID: CVE-2024-24904 State: PUBLISHED Published: 2024-03-01T13:24:01.513Z Last Updated: 2024-08-01T23:28:13.121Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N) Vendors: Dell Products: Secure Connect Gateway (SCG) Policy Manager Problem Types: CWE-79 Description: Dell Secure Connect Gateway (SCG) Policy Manager, all versions, contain(s) a Stored Cross-Site Scripting Vulnerability. An adjacent network high privileged attacker could potentially exploit this vulnerability, leading to the storage of malicious HTML or JavaScript codes in a trusted application data store. When a victim user accesses the data store through their browsers, the malicious code gets executed by
ation data store. When a victim user accesses the data store through their browsers, the malicious code gets executed by the web browser in the context of the vulnerable web application. Exploitation may lead to information disclosure, session theft, or client-side request forgery. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/en-us/000222330/dsa-2024-077-security-update-for-dell-secure-connect-gateway-policy-manager-vulnerabilities
CVE ID: CVE-2024-24905 State: PUBLISHED Published: 2024-03-01T13:19:33.871Z Last Updated: 2024-08-26T18:38:40.292Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N) Vendors: Dell Products: Secure Connect Gateway (SCG) Policy Manager Problem Types: CWE-79 Description: Dell Secure Connect Gateway (SCG) Policy Manager, all versions, contain(s) a Stored Cross-Site Scripting Vulnerability. An adjacent network high privileged attacker could potentially exploit this vulnerability, leading to the storage of malicious HTML or JavaScript codes in a trusted application data store. When a victim user accesses the data store through their browsers, the malicious code gets executed by
CVE ID: CVE-2024-24906 State: PUBLISHED Published: 2024-03-01T13:06:31.021Z Last Updated: 2024-08-01T23:28:12.896Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N) Vendors: Dell Products: Secure Connect Gateway (SCG) Policy Manager Problem Types: CWE-79 Description: Dell Secure Connect Gateway (SCG) Policy Manager, all versions, contain(s) a Stored Cross-Site Scripting Vulnerability in Policy page. An adjacent network high privileged attacker could potentially exploit this vulnerability, leading to the storage of malicious HTML or JavaScript codes in a trusted application data store. When a victim user accesses the data store through their browsers, the malicious code g
trusted application data store. When a victim user accesses the data store through their browsers, the malicious code gets executed by the web browser in the context of the vulnerable web application. Exploitation may lead to information disclosure, session theft, or client-side request forgery. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/en-us/000222330/dsa-2024-077-security-update-for-dell-secure-connect-gateway-policy-manager-vulnerabilities
CVE ID: CVE-2024-24907 State: PUBLISHED Published: 2024-03-01T13:14:30.093Z Last Updated: 2024-08-15T19:05:32.153Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N) Vendors: Dell Products: Secure Connect Gateway (SCG) Policy Manager Problem Types: CWE-79 Description: Dell Secure Connect Gateway (SCG) Policy Manager, all versions, contain(s) a Stored Cross-Site Scripting Vulnerability in the Filters page. An adjacent network high privileged attacker could potentially exploit this vulnerability, leading to the storage of malicious HTML or JavaScript codes in a trusted application data store. When a victim user accesses the data store through their browsers, the malicious c
in a trusted application data store. When a victim user accesses the data store through their browsers, the malicious code gets executed by the web browser in the context of the vulnerable web application. Exploitation may lead to information disclosure, session theft, or client-side request forgery. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000222330/dsa-2024-077-security-update-for-dell-secure-connect-gateway-policy-manager-vulnerabilities