Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-20142 State: PUBLISHED Published: 2025-02-03T03:23:57.752Z Last Updated: 2025-02-03T17:24:00.470Z Vendors: MediaTek, Inc. Products: MT6739, MT6761, MT6765, MT6768, MT6771, MT6779, MT6781, MT6785, MT6833, MT6853, MT6873, MT6877, MT6885, MT6893, MT8167, MT8167S, MT8175, MT8185, MT8195, MT8321, MT8362A, MT8365, MT8385, MT8395, MT8666, MT8667, MT8673, MT8675, MT8678, MT8765, MT8766, MT8768, MT8771, MT8775, MT8781, MT8786, MT8788, MT8789, MT8791T, MT8795T, MT8797, MT8798, MT8893 Problem Types: CWE-787 Description: In V5 DA, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege, if an attacker has physical access to
e due to a missing bounds check. This could lead to local escalation of privilege, if an attacker has physical access to the device, with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS09291406; Issue ID: MSV-2070. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://corp.mediatek.com/product-security-bulletin/February-2025
CVE ID: CVE-2024-20143 State: PUBLISHED Published: 2025-01-06T03:17:44.887Z Last Updated: 2025-01-06T14:19:40.346Z Vendors: MediaTek, Inc. Products: MT2737, MT6781, MT6789, MT6835, MT6855, MT6878, MT6879, MT6880, MT6886, MT6890, MT6895, MT6897, MT6980, MT6983, MT6985, MT6989, MT6990, MT8370, MT8390, MT8676 Problem Types: CWE-787 Description: In V6 DA, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege, if an attacker has physical access to the device, with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS09167056; Issue ID: MSV-2069. Additional Analyst Notes: - CISA ADP V
teraction is needed for exploitation. Patch ID: ALPS09167056; Issue ID: MSV-2069. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://corp.mediatek.com/product-security-bulletin/January-2025
CVE ID: CVE-2024-20144 State: PUBLISHED Published: 2025-01-06T03:17:46.455Z Last Updated: 2025-01-06T14:18:57.284Z Vendors: MediaTek, Inc. Products: MT2737, MT6739, MT6761, MT6765, MT6768, MT6771, MT6779, MT6781, MT6785, MT6789, MT6833, MT6835, MT6853, MT6855, MT6873, MT6877, MT6878, MT6879, MT6880, MT6885, MT6886, MT6890, MT6893, MT6895, MT6897, MT6980, MT6985, MT6989, MT6990, MT8370, MT8390, MT8676 Problem Types: CWE-787 Description: In V6 DA, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege, if an attacker has physical access to the device, with no additional execution privileges needed. User interaction is needed for
acker has physical access to the device, with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS09167056; Issue ID: MSV-2041. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://corp.mediatek.com/product-security-bulletin/January-2025
CVE ID: CVE-2024-20145 State: PUBLISHED Published: 2025-01-06T03:17:48.166Z Last Updated: 2025-01-06T14:18:04.465Z Vendors: MediaTek, Inc. Products: MT2737, MT6781, MT6789, MT6835, MT6855, MT6878, MT6879, MT6880, MT6886, MT6890, MT6895, MT6897, MT6980, MT6983, MT6985, MT6989, MT6990, MT8676 Problem Types: CWE-787 Description: In V6 DA, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege, if an attacker has physical access to the device, with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS09290940; Issue ID: MSV-2040. Additional Analyst Notes: - CISA ADP Vulnrichment: Ref
ded for exploitation. Patch ID: ALPS09290940; Issue ID: MSV-2040. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://corp.mediatek.com/product-security-bulletin/January-2025
CVE ID: CVE-2024-20146 State: PUBLISHED Published: 2025-01-06T03:17:49.872Z Last Updated: 2025-01-08T04:55:49.141Z Vendors: MediaTek, Inc. Products: MT2737, MT3603, MT6835, MT6878, MT6886, MT6897, MT6990, MT7902, MT7920, MT7922, MT8365, MT8518S, MT8532, MT8666, MT8667, MT8673, MT8755, MT8766, MT8768, MT8775, MT8781, MT8786, MT8788, MT8796, MT8798, MT8893 Problem Types: CWE-787 Description: In wlan STA driver, there is a possible out of bounds write due to improper input validation. This could lead to remote (proximal/adjacent) code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00389496 / ALPS09137491; Issue ID: MSV-1
vileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00389496 / ALPS09137491; Issue ID: MSV-1835. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://corp.mediatek.com/product-security-bulletin/January-2025
CVE ID: CVE-2024-20147 State: PUBLISHED Published: 2025-02-03T03:24:09.635Z Last Updated: 2025-02-03T16:24:37.635Z Vendors: MediaTek, Inc. Products: MT2737, MT3603, MT6835, MT6878, MT6886, MT6897, MT6985, MT6989, MT6990, MT7902, MT7920, MT7921, MT7922, MT7925, MT7927, MT8195, MT8370, MT8390, MT8395, MT8518S, MT8532, MT8678 Problem Types: CWE-617 Description: In Bluetooth FW, there is a possible reachable assertion due to improper exception handling. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00389046 (Note: For MT79XX chipsets) / ALPS09136501 (Note: For MT2737, MT3603, MT6XXX, and
exploitation. Patch ID: WCNCR00389046 (Note: For MT79XX chipsets) / ALPS09136501 (Note: For MT2737, MT3603, MT6XXX, and MT8XXX chipsets); Issue ID: MSV-1797. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://corp.mediatek.com/product-security-bulletin/February-2025
CVE ID: CVE-2024-20148 State: PUBLISHED Published: 2025-01-06T03:17:51.547Z Last Updated: 2025-01-08T04:55:50.305Z Vendors: MediaTek, Inc. Products: MT3603, MT6835, MT6878, MT6886, MT6897, MT7902, MT7920, MT7922, MT8518S, MT8532, MT8766, MT8768, MT8775, MT8796, MT8798 Problem Types: CWE-787 Description: In wlan STA FW, there is a possible out of bounds write due to improper input validation. This could lead to remote (proximal/adjacent) code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00389045 / ALPS09136494; Issue ID: MSV-1796. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://corp.mediatek.
LPS09136494; Issue ID: MSV-1796. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://corp.mediatek.com/product-security-bulletin/January-2025
CVE ID: CVE-2024-20149 State: PUBLISHED Published: 2025-01-06T03:17:54.848Z Last Updated: 2025-01-06T14:14:31.982Z Vendors: MediaTek, Inc. Products: MT2735, MT2737, MT6767, MT6768, MT6769, MT6769K, MT6769S, MT6769T, MT6769Z, MT6779, MT6781, MT6783, MT6785, MT6785T, MT6785U, MT6789, MT6833P, MT6835, MT6835T, MT6853, MT6853T, MT6855, MT6855T, MT6873, MT6875, MT6875T, MT6877, MT6877T, MT6877TT, MT6878, MT6878M, MT6879, MT6880, MT6880T, MT6880U, MT6883, MT6885, MT6886, MT6889, MT6890, MT6891, MT6893, MT6895, MT6895TT, MT6896, MT6897, MT6899, MT6980, MT6980D, MT6983T, MT6985, MT6985T, MT6989, MT6989T, MT6990, MT6991, MT8666, MT8673, MT8675, MT8676, MT8678, MT8765, MT8766, MT8768, MT8771, MT8781,
6985T, MT6989, MT6989T, MT6990, MT6991, MT8666, MT8673, MT8675, MT8676, MT8678, MT8765, MT8766, MT8768, MT8771, MT8781, MT8786, MT8788, MT8788E, MT8789, MT8791T, MT8795T, MT8797, MT8798, MT8863 Problem Types: CWE-1284 Description: In Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01231341 / MOLY01263331 / MOLY01233835; Issue ID: MSV-2165. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://corp.mediatek.com/product-security-bulletin/January-2025
CVE ID: CVE-2024-20150 State: PUBLISHED Published: 2025-01-06T03:17:56.513Z Last Updated: 2025-01-06T14:13:53.673Z Vendors: MediaTek, Inc. Products: MT2735, MT2737, MT6767, MT6768, MT6769, MT6769K, MT6769S, MT6769T, MT6769Z, MT6779, MT6781, MT6783, MT6785, MT6785T, MT6785U, MT6789, MT6833P, MT6835, MT6835T, MT6853, MT6853T, MT6855, MT6855T, MT6873, MT6875, MT6875T, MT6877, MT6877T, MT6877TT, MT6878, MT6878M, MT6879, MT6880, MT6880T, MT6880U, MT6883, MT6885, MT6886, MT6889, MT6890, MT6891, MT6893, MT6895, MT6895TT, MT6896, MT6897, MT6899, MT6980, MT6980D, MT6983T, MT6985, MT6985T, MT6989, MT6989T, MT6990, MT6991, MT8666, MT8673, MT8675, MT8676, MT8678, MT8765, MT8766, MT8768, MT8771, MT8781,
6985T, MT6989, MT6989T, MT6990, MT6991, MT8666, MT8673, MT8675, MT8676, MT8678, MT8765, MT8766, MT8768, MT8771, MT8781, MT8786, MT8788, MT8788E, MT8789, MT8791T, MT8795T, MT8797, MT8798, MT8863 Problem Types: CWE-502 Description: In Modem, there is a possible system crash due to a logic error. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01412526; Issue ID: MSV-2018. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://corp.mediatek.com/product-security-bulletin/January-2025
CVE ID: CVE-2024-20151 State: PUBLISHED Published: 2025-01-06T03:17:58.239Z Last Updated: 2025-01-06T14:13:12.730Z Vendors: MediaTek, Inc. Products: MT2737, MT2739, MT6789, MT6813, MT6815, MT6835, MT6835T, MT6855, MT6878, MT6878T, MT6879, MT6886, MT6895, MT6895T, MT6896, MT6897, MT6899, MT6980, MT6980D, MT6983, MT6985, MT6986, MT6986D, MT6988, MT6989, MT6990, MT6991, MT8676, MT8678, MT8798, MT8863 Problem Types: CWE-787 Description: In Modem, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: MOLY013
ious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: MOLY01399339; Issue ID: MSV-1928. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://corp.mediatek.com/product-security-bulletin/January-2025
CVE ID: CVE-2024-20152 State: PUBLISHED Published: 2025-01-06T03:17:59.918Z Last Updated: 2025-01-06T14:12:39.277Z Vendors: MediaTek, Inc. Products: MT2737, MT3603, MT6835, MT6878, MT6886, MT6897, MT6990, MT7902, MT7920, MT7922, MT8518S, MT8532, MT8755, MT8766, MT8768, MT8775, MT8781, MT8796, MT8798, MT8893 Problem Types: CWE-617 Description: In wlan STA driver, there is a possible reachable assertion due to improper exception handling. This could lead to local denial of service if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: WCNCR00389047 / ALPS09136505; Issue ID: MSV-1798. Additional Analyst Notes: - CISA ADP Vulnri
or exploitation. Patch ID: WCNCR00389047 / ALPS09136505; Issue ID: MSV-1798. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://corp.mediatek.com/product-security-bulletin/January-2025
CVE ID: CVE-2024-20153 State: PUBLISHED Published: 2025-01-06T03:18:01.542Z Last Updated: 2025-01-06T14:11:35.078Z Vendors: MediaTek, Inc. Products: MT2737, MT6989, MT6991, MT7925, MT8365, MT8518S, MT8532, MT8666, MT8667, MT8673, MT8676, MT8678, MT8755, MT8766, MT8768, MT8775, MT8781, MT8786, MT8788, MT8796, MT8798, MT8893 Problem Types: CWE-304 Description: In wlan STA, there is a possible way to trick a client to connect to an AP with spoofed SSID. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08990446 / ALPS09057442; Issue ID: MSV-1598. Additional Analyst Notes: - CISA ADP Vul
ed for exploitation. Patch ID: ALPS08990446 / ALPS09057442; Issue ID: MSV-1598. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://corp.mediatek.com/product-security-bulletin/January-2025
CVE ID: CVE-2024-20154 State: PUBLISHED Published: 2025-01-06T03:17:41.540Z Last Updated: 2025-01-08T04:55:47.976Z Vendors: MediaTek, Inc. Products: MT2735, MT6767, MT6768, MT6769, MT6769K, MT6769S, MT6769T, MT6769Z, MT6779, MT6781, MT6783, MT6785, MT6785T, MT6785U, MT6789, MT6833P, MT6853, MT6853T, MT6855, MT6855T, MT6873, MT6875, MT6875T, MT6877, MT6877T, MT6877TT, MT6880, MT6880T, MT6880U, MT6883, MT6885, MT6889, MT6890, MT6891, MT6893, MT8666, MT8673, MT8675, MT8765, MT8766, MT8768, MT8771, MT8781, MT8786, MT8788, MT8788E, MT8789, MT8791T, MT8795T, MT8797, MT8798 Problem Types: CWE-121 Description: In Modem, there is a possible out of bounds write due to a missing bounds check. This coul
m Types: CWE-121 Description: In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY00720348; Issue ID: MSV-2392. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://corp.mediatek.com/product-security-bulletin/January-2025
CVE ID: CVE-2024-20251 State: PUBLISHED Published: 2024-01-17T16:55:07.485Z Last Updated: 2024-10-21T11:54:43.472Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: Cisco Products: Cisco Identity Services Engine Software Problem Types: CWE-79 Description: A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to perform a stored cross-site scripting (XSS) attack against a user of the interface on an affected device. This vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability b
ased management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by injecting malicious code into specific pages of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ISE-XSS-bL4VTML
CVE ID: CVE-2024-20252 State: PUBLISHED Published: 2024-02-07T16:15:06.066Z Last Updated: 2024-08-01T21:52:31.791Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: Cisco Products: Cisco TelePresence Video Communication Server (VCS) Expressway Problem Types: CWE-352 Description: Multiple vulnerabilities in Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an unauthenticated, remote attacker to conduct cross-site request forgery (CSRF) attacks that perform arbitrary actions on an affected device. Note: "Cisco Expressway Series" refers to Cisco Expressway Control (Expressway-C) devices and Cisco Expressway Edge (Expres
e: "Cisco Expressway Series" refers to Cisco Expressway Control (Expressway-C) devices and Cisco Expressway Edge (Expressway-E) devices. For more information about these vulnerabilities, see the Details ["#details"] section of this advisory. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-csrf-KnnZDMj3
CVE ID: CVE-2024-20253 State: PUBLISHED Published: 2024-01-26T17:28:30.761Z Last Updated: 2025-05-29T15:12:21.257Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H) Vendors: Cisco Products: Cisco Unified Contact Center Enterprise, Cisco Unity Connection, Cisco Unified Communications Manager, Cisco Unified Contact Center Express, Cisco Unified Communications Manager IM and Presence Service, Cisco Virtualized Voice Browser, Cisco Packaged Contact Center Enterprise, Cisco Unified Communications Manager / Cisco Unity Connection Problem Types: CWE-502 Description: A vulnerability in multiple Cisco Unified Communications and Contact Center Solutions products could allow an
scription: A vulnerability in multiple Cisco Unified Communications and Contact Center Solutions products could allow an unauthenticated, remote attacker to execute arbitrary code on an affected device. This vulnerability is due to the improper processing of user-provided data that is being read into memory. An attacker could exploit this vulnerability by sending a crafted message to a listening port of an affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with the privileges of the web services user. With access to the underlying operating system, the attacker could also establish root access on the affected device
er. With access to the underlying operating system, the attacker could also establish root access on the affected device. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-rce-bWNzQcUm
CVE ID: CVE-2024-20254 State: PUBLISHED Published: 2024-02-07T16:15:25.666Z Last Updated: 2024-08-22T18:53:32.471Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: Cisco Products: Cisco TelePresence Video Communication Server (VCS) Expressway Problem Types: CWE-352 Description: Multiple vulnerabilities in Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an unauthenticated, remote attacker to conduct cross-site request forgery (CSRF) attacks that perform arbitrary actions on an affected device. Note: "Cisco Expressway Series" refers to Cisco Expressway Control (Expressway-C) devices and Cisco Expressway Edge (Expres
e: "Cisco Expressway Series" refers to Cisco Expressway Control (Expressway-C) devices and Cisco Expressway Edge (Expressway-E) devices. For more information about these vulnerabilities, see the Details ["#details"] section of this advisory. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-csrf-KnnZDMj3
CVE ID: CVE-2024-20255 State: PUBLISHED Published: 2024-02-07T16:15:36.068Z Last Updated: 2025-05-08T18:48:03.125Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:L) Vendors: Cisco Products: Cisco TelePresence Video Communication Server (VCS) Expressway Problem Types: CWE-352 Description: A vulnerability in the SOAP API of Cisco Expressway Series and Cisco TelePresence Video Communication Server could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system. This vulnerability is due to insufficient CSRF protections for the web-based management interface of an affected system. An attacker could exploit this vuln
cient CSRF protections for the web-based management interface of an affected system. An attacker could exploit this vulnerability by persuading a user of the REST API to follow a crafted link. A successful exploit could allow the attacker to cause the affected system to reload. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-csrf-KnnZDMj3
CVE ID: CVE-2024-20256 State: PUBLISHED Published: 2024-05-15T17:56:38.074Z Last Updated: 2024-08-15T15:29:20.282Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: Cisco Products: Cisco Secure Web Appliance, Cisco Secure Email and Web Manager Problem Types: CWE-79 Description: A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager and Secure Web Appliance could allow an authenticated, remote attacker to conduct an XSS attack against a user of the interface. This vulnerability is due to insufficient validation of user input. An attacker could exploit this vulnerability by persuading a user of an a
due to insufficient validation of user input. An attacker could exploit this vulnerability by persuading a user of an affected interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-sma-wsa-xss-bgG5WHOD
CVE ID: CVE-2024-20257 State: PUBLISHED Published: 2024-05-15T17:58:59.579Z Last Updated: 2024-08-01T21:52:31.675Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: Cisco Products: Cisco Secure Email Problem Types: CWE-79 Description: A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an authenticated, remote attacker to conduct an XSS attack against a user of the interface.r This vulnerability is due to insufficient validation of user input. An attacker could exploit this vulnerability by persuading a user of an affected interface to click a crafted link. A successful exploit could allow
s vulnerability by persuading a user of an affected interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-sma-wsa-xss-bgG5WHOD
CVE ID: CVE-2024-20258 State: PUBLISHED Published: 2024-05-15T17:32:16.125Z Last Updated: 2024-08-01T21:52:31.784Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Cisco Products: Cisco Secure Email, Cisco Secure Email and Web Manager Problem Types: CWE-79 Description: A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager and Secure Email Gateway could allow an unauthenticated, remote attacker to conduct an XSS attack against a user of the interface. This vulnerability is due to insufficient validation of user input. An attacker could exploit this vulnerability by persuading a user of an affecte
o insufficient validation of user input. An attacker could exploit this vulnerability by persuading a user of an affected interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-sma-wsa-xss-bgG5WHOD
CVE ID: CVE-2024-20259 State: PUBLISHED Published: 2024-03-27T16:53:53.073Z Last Updated: 2024-08-27T21:04:37.666Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) Vendors: Cisco Products: Cisco IOS XE Software Problem Types: CWE-122 Description: A vulnerability in the DHCP snooping feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is due to a crafted IPv4 DHCP request packet being mishandled when endpoint analytics are enabled. An attacker could exploit this vulnerability by sending a crafted DHCP request through an aff