Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-9816 State: PUBLISHED Published: 2024-10-10T22:00:06.771Z Last Updated: 2024-10-11T15:22:45.115Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: Codezips Products: Tourist Management System Problem Types: CWE-434 Description: A vulnerability was found in Codezips Tourist Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/change-image.php. The manipulation of the argument packageimage leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/
losed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.279968 - https://vuldb.com/?ctiid.279968 - https://vuldb.com/?submit.418918 - https://github.com/ppp-src/CVE/issues/13
CVE ID: CVE-2024-9817 State: PUBLISHED Published: 2024-10-10T22:31:04.936Z Last Updated: 2024-10-11T15:05:00.220Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: code-projects Products: Blood Bank System Problem Types: CWE-89 Description: A vulnerability was found in code-projects Blood Bank System 1.0. It has been classified as critical. This affects an unknown part of the file /update.php. The manipulation of the argument name leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.279969 - https://vuldb.com/?ctiid
Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.279969 - https://vuldb.com/?ctiid.279969 - https://vuldb.com/?submit.421134 - https://github.com/RonenWen/cve/blob/main/sql6-update-name.md - https://code-projects.org/
CVE ID: CVE-2024-9818 State: PUBLISHED Published: 2024-10-10T22:31:06.936Z Last Updated: 2024-10-11T15:03:21.045Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: SourceCodester Products: Online Veterinary Appointment System Problem Types: CWE-89 Description: A vulnerability classified as critical has been found in SourceCodester Online Veterinary Appointment System 1.0. Affected is an unknown function of the file /admin/categories/manage_category.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References:
xploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.279972 - https://vuldb.com/?ctiid.279972 - https://vuldb.com/?submit.421548 - https://github.com/fezzyang/CVE_report/blob/main/online-veterinary-appointment-system/SQLi.md - https://www.sourcecodester.com/
CVE ID: CVE-2024-9819 State: PUBLISHED Published: 2024-12-17T12:55:32.225Z Last Updated: 2024-12-17T17:34:03.447Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: NextGeography Products: NG Analyser Problem Types: CWE-639 Description: Authorization Bypass Through User-Controlled Key vulnerability in NextGeography NG Analyser allows Functionality Misuse.This issue affects NG Analyser: before 2.2.711. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-24-1889
CVE ID: CVE-2024-9820 State: PUBLISHED Published: 2024-10-15T02:03:53.185Z Last Updated: 2024-10-15T13:41:01.850Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: dueclic Products: WP 2FA with Telegram Problem Types: CWE-784 Description: The WP 2FA with Telegram plugin for WordPress is vulnerable to Two-Factor Authentication Bypass in versions up to, and including, 3.0. This is due to the two-factor code being stored in a cookie, which makes it possible to bypass two-factor authentication. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ccd73030-7185-4302-b3fd-29cbbe716e3e?source=cve -
eferences: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ccd73030-7185-4302-b3fd-29cbbe716e3e?source=cve - https://plugins.trac.wordpress.org/browser/two-factor-login-telegram/tags/3.0/includes/class-wp-factor-telegram-plugin.php#L228
CVE ID: CVE-2024-9821 State: PUBLISHED Published: 2024-10-12T02:05:45.133Z Last Updated: 2024-10-15T16:07:44.061Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: guruteam Products: Bot for Telegram on WooCommerce Problem Types: CWE-200 Description: The Bot for Telegram on WooCommerce plugin for WordPress is vulnerable to sensitive information disclosure due to missing authorization checks on the 'stm_wpcfto_get_settings' AJAX action in all versions up to, and including, 1.2.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to view the Telegram Bot Token, a secret token used to control the bot, which can then be used
r-level access and above, to view the Telegram Bot Token, a secret token used to control the bot, which can then be used to log in as any existing user on the site, such as an administrator, if they know the username, due to the Login with Telegram feature. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a662c904-ba2e-494c-a603-b22eeeddf43d?source=cve - https://plugins.trac.wordpress.org/browser/bot-for-telegram-on-woocommerce/trunk/nuxy/helpers/helpers.php?rev=2575772#L54
CVE ID: CVE-2024-9822 State: PUBLISHED Published: 2024-10-11T02:32:46.048Z Last Updated: 2024-10-11T14:52:04.050Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: pedaloagency Products: Pedalo Connector Problem Types: CWE-288 Description: The Pedalo Connector plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.0.5. This is due to insufficient restriction on the 'login_admin_user' function. This makes it possible for unauthenticated attackers to log to the first user, who is usually the administrator, or if it does not exist, then to the first administrator. Additional Analyst Notes: - CISA ADP Vulnrichment: Refere
tor, or if it does not exist, then to the first administrator. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6ab0d342-bfa7-4760-b839-37c3354414ca?source=cve - https://plugins.trac.wordpress.org/browser/pedalo-connector/tags/2.0.5/public/class-pedalo_connector-public.php#L118
CVE ID: CVE-2024-9823 State: PUBLISHED Published: 2024-10-14T15:03:02.293Z Last Updated: 2025-11-03T19:35:02.369Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Eclipse Foundation, Eclipse Jetty Products: Jetty Problem Types: CWE-400 Description: There exists a security vulnerability in Jetty's DosFilter which can be exploited by unauthorized users to cause remote denial-of-service (DoS) attack on the server using DosFilter. By repeatedly sending crafted requests, attackers can trigger OutofMemory errors and exhaust the server's memory finally. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/jetty
ally. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/jetty/jetty.project/security/advisories/GHSA-7hcf-ppf8-5w5h - https://gitlab.eclipse.org/security/cve-assignement/-/issues/39 - https://github.com/jetty/jetty.project/issues/1256
CVE ID: CVE-2024-9824 State: PUBLISHED Published: 2024-10-12T05:39:39.419Z Last Updated: 2024-10-15T13:25:30.962Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: butterflymedia Products: ImagePress – Image Gallery Problem Types: CWE-862 Description: The ImagePress – Image Gallery plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on the 'ip_delete_post' and 'ip_update_post_title' functions in all versions up to, and including, 1.2.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary posts and update post titles. Additional Analyst Not
ackers, with Subscriber-level access and above, to delete arbitrary posts and update post titles. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3bce6872-34d4-4675-bce9-e1197d801bce?source=cve - https://plugins.trac.wordpress.org/browser/image-gallery/trunk/includes/functions.php#L204 - https://plugins.trac.wordpress.org/browser/image-gallery/trunk/includes/functions.php#L214 - https://plugins.trac.wordpress.org/changeset/3167164/
CVE ID: CVE-2024-9825 State: PUBLISHED Published: 2024-10-28T18:42:39.786Z Last Updated: 2024-10-29T13:33:52.268Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: Progress Software Corporation Products: Chef Habitat Builder Problem Types: CWE-863 Description: The Chef Habitat builder-api on-prem-builder package with any version lower than habitat/builder-api/10315/20240913162802 is vulnerable to indirect object reference (IDOR) by un-authorized deletion of personal token. Habitat builder consumes builder-api habitat package as a dependency and the vulnerability was specifically due to builder-api habitat package. The fix was made available in habitat/builder-
nd the vulnerability was specifically due to builder-api habitat package. The fix was made available in habitat/builder-api/10315/20240913162802 and all the subsequent versions after that. We would recommend user to always use on-prem stable channel. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.chef.io/habitat/builder_overview/ - https://community.progress.com/s/article/Chef-Habitat-Builder-Product-Alert
CVE ID: CVE-2024-9826 State: PUBLISHED Published: 2024-10-29T21:14:31.382Z Last Updated: 2025-08-26T18:39:48.177Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Autodesk Products: AutoCAD, AutoCAD Architecture, AutoCAD Electrical, AutoCAD MAP 3D, AutoCAD Mechanical, AutoCAD MEP, AutoCAD Plant 3D, Civil 3D, Advance Steel Problem Types: CWE-416 Description: A maliciously crafted 3DM file when parsed in atf_api.dll through Autodesk AutoCAD can force a Use-After-Free vulnerability. A malicious actor can leverage this vulnerability to cause a crash, write sensitive data, or execute arbitrary code in the context of the current process. Additional Analyst Notes: - C
CVE ID: CVE-2024-9827 State: PUBLISHED Published: 2024-10-29T21:14:55.716Z Last Updated: 2025-04-25T20:30:38.082Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Autodesk Products: AutoCAD, AutoCAD Architecture, AutoCAD Electrical, AutoCAD MAP 3D, AutoCAD Mechanical, AutoCAD MEP, AutoCAD Plant 3D, Civil 3D, Advance Steel Problem Types: CWE-125 Description: A maliciously crafted CATPART file when parsed in CC5Dll.dll through Autodesk AutoCAD can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process. Additional Analyst Not
se a crash, read sensitive data, or execute arbitrary code in the context of the current process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0019
CVE ID: CVE-2024-9828 State: PUBLISHED Published: 2024-11-21T06:00:10.648Z Last Updated: 2024-11-21T18:38:17.399Z Vendors: Unknown Products: Taskbuilder Problem Types: CWE-89 SQL Injection Description: The Taskbuilder WordPress plugin before 3.0.5 does not sanitize user input into the 'load_orders' parameter and uses it in a SQL statement, allowing high privilege users such as admin to perform SQL Injection attacks Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/eb2d0932-fd47-4aef-9d08-4377c742bb6e/
CVE ID: CVE-2024-9829 State: PUBLISHED Published: 2024-10-23T05:35:06.432Z Last Updated: 2024-10-23T14:02:17.934Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: metagauss Products: Download Plugin Problem Types: CWE-862 Description: The Download Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability checks on the 'dpwap_handle_download_user' and 'dpwap_handle_download_comment' functions in all versions up to, and including, 2.2.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to download any comment, and download metadata for any user including user PII and sensitive
ber-level access and above, to download any comment, and download metadata for any user including user PII and sensitive information including username, email, hashed passwords and application passwords, session token information and more depending on set up and additional plugins installed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e0891211-e4b3-4dcf-8ee0-e20abeb91640?source=cve - https://plugins.trac.wordpress.org/browser/download-plugin/trunk/download-plugin.php#L262 - https://plugins.trac.wordpress.org/browser/download-plugin/trunk/download-plugin.php#L335 - https://plugins.trac.wordpress.org/browser/downloa
ordpress.org/browser/download-plugin/trunk/download-plugin.php#L335 - https://plugins.trac.wordpress.org/browser/download-plugin/trunk/download-plugin.php#L242 - https://plugins.trac.wordpress.org/changeset/3170600/
CVE ID: CVE-2024-9830 State: PUBLISHED Published: 2024-11-19T12:45:32.540Z Last Updated: 2024-11-19T14:01:50.269Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: wproyal Products: Bard Problem Types: CWE-79 Description: The Bard theme for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.216. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: Re
trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9aff1e5b-2f16-43d0-b75a-c07e59a9c15f?source=cve - https://wordpress.org/themes/bard/ - https://themes.trac.wordpress.org/browser/bard/2.216/functions.php#L98 - https://themes.trac.wordpress.org/browser/bard/2.216/functions.php#L109 - https://themes.trac.wordpress.org/changeset/248854/
CVE ID: CVE-2024-9831 State: PUBLISHED Published: 2025-05-15T20:07:23.612Z Last Updated: 2025-05-16T13:52:11.347Z Vendors: Unknown Products: Taskbuilder Problem Types: CWE-89 SQL Injection Description: The Taskbuilder WordPress plugin before 3.0.9 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/390baaf8-a162-43e5-9367-0d2e979d89f7/
CVE ID: CVE-2024-9832 State: PUBLISHED Published: 2024-11-14T21:03:16.721Z Last Updated: 2024-11-18T15:37:00.311Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Baxter Products: Life2000 Ventilation System Problem Types: CWE-307 Description: There is no limit on the number of failed login attempts permitted with the Clinician Password or the Serial Number Clinician Password. An attacker could execute a brute-force attack to gain unauthorized access to the ventilator, and then make changes to device settings that could disrupt the function of the device and/or result in unauthorized information disclosure. Additional Analyst Notes: - CISA ADP Vulnrichment:
n of the device and/or result in unauthorized information disclosure. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-319-01
CVE ID: CVE-2024-9834 State: PUBLISHED Published: 2024-11-14T20:57:22.734Z Last Updated: 2024-11-15T15:10:40.157Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Baxter Products: Life2000 Ventilation System Problem Types: CWE-319 Description: Improper data protection on the ventilator's serial interface could allow an attacker to send and receive messages that result in unauthorized disclosure of information and/or have unintended impacts on device settings and performance. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-319-01
CVE ID: CVE-2024-9835 State: PUBLISHED Published: 2024-11-12T06:00:04.015Z Last Updated: 2024-11-12T14:31:10.703Z Vendors: Unknown Products: RSS Feed Widget Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The RSS Feed Widget WordPress plugin before 3.0.1 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/0277b060-805d-4b85-b5a4-fa93a731cd8d/
CVE ID: CVE-2024-9836 State: PUBLISHED Published: 2024-11-12T06:00:04.726Z Last Updated: 2024-11-12T14:28:45.998Z Vendors: Unknown Products: RSS Feed Widget Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The RSS Feed Widget WordPress plugin before 3.0.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/f87af54e-3e58-4c29-8a30-e7d52234c9d4/
CVE ID: CVE-2024-9837 State: PUBLISHED Published: 2024-10-15T07:30:33.772Z Last Updated: 2024-10-15T13:31:17.520Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: numanrki Products: AADMY – Add Auto Date Month Year Into Posts Problem Types: CWE-94 Description: The The AADMY – Add Auto Date Month Year Into Posts plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.0.1. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. Additional Analyst Notes
hortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/fb165cba-34a9-42d9-bfd5-31a290d02311?source=cve - https://wordpress.org/plugins/auto-date-year-month/#developers - https://plugins.trac.wordpress.org/browser/auto-date-year-month/trunk/auto-date-year-month.php#L218 - https://plugins.trac.wordpress.org/changeset/3167908/
CVE ID: CVE-2024-9838 State: PUBLISHED Published: 2025-05-15T20:07:23.917Z Last Updated: 2025-05-16T20:27:05.196Z Vendors: Unknown Products: Auto Affiliate Links Problem Types: CWE-89 SQL Injection Description: The Auto Affiliate Links WordPress plugin before 6.4.7 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/3cc0ff78-b310-40a4-899c-15fecbb345c5/
CVE ID: CVE-2024-9839 State: PUBLISHED Published: 2024-11-16T03:20:53.230Z Last Updated: 2024-11-19T16:08:08.147Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: uiuxlab Products: Uix Slideshow Problem Types: CWE-94 Description: The The Uix Slideshow plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.6.5. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfenc
s to execute arbitrary shortcodes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f189f606-ec30-4f5d-81c9-d526ba7141f0?source=cve - https://wordpress.org/plugins/uix-slideshow/#developers - https://plugins.trac.wordpress.org/browser/uix-slideshow/trunk/includes/shortcodes.php#L26
CVE ID: CVE-2024-9840 State: REJECTED Published: 2025-03-20T10:09:04.285Z Last Updated: 2025-04-15T15:52:08.030Z Description: No description available.
CVE ID: CVE-2024-9841 State: PUBLISHED Published: 2024-11-08T17:58:53.697Z Last Updated: 2024-11-08T21:12:48.283Z Vendors: OpenText Products: ArcSight Management Center, ArcSight Platform Problem Types: CWE-79 Description: A Reflected Cross-Site Scripting (XSS) vulnerability has been identified in OpenText ArcSight Management Center and ArcSight Platform. The vulnerability could be remotely exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://portal.microfocus.com/s/article/KM000035977
CVE ID: CVE-2024-9842 State: PUBLISHED Published: 2024-11-12T16:12:12.164Z Last Updated: 2024-11-12T18:24:53.695Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H) Vendors: Ivanti Products: Secure Access Client Problem Types: CWE-732, CWE-267 Description: Incorrect permissions in Ivanti Secure Access Client before version 22.7R4 allows a local authenticated attacker to create arbitrary folders. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-ICS-Ivanti-Policy-Secure-IPS-Ivanti-Secure-Access-Client-ISAC-Multiple-CVEs
CVE ID: CVE-2024-9843 State: PUBLISHED Published: 2024-11-12T16:13:09.060Z Last Updated: 2024-11-12T17:21:52.651Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H) Vendors: Ivanti Products: Secure Access Client Problem Types: CWE-126 Description: A buffer over-read in Ivanti Secure Access Client before 22.7R4 allows a local unauthenticated attacker to cause a denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-ICS-Ivanti-Policy-Secure-IPS-Ivanti-Secure-Access-Client-ISAC-Multiple-CVEs
CVE ID: CVE-2024-9844 State: PUBLISHED Published: 2024-12-10T18:46:56.314Z Last Updated: 2024-12-10T20:39:59.067Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N) Vendors: Ivanti Products: Connect Secure Problem Types: CWE-602 Description: Insufficient server-side controls in Secure Application Manager of Ivanti Connect Secure before version 22.7R2.4 allows a remote authenticated attacker to bypass restrictions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/December-2024-Security-Advisory-Ivanti-Connect-Secure-ICS-and-Ivanti-Policy-Secure-IPS-Multiple-CVEs
CVE ID: CVE-2024-9845 State: PUBLISHED Published: 2024-12-11T16:41:39.804Z Last Updated: 2024-12-19T04:55:29.963Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Ivanti Products: Automation Problem Types: CWE-276 Description: Under specific circumstances, insecure permissions in Ivanti Automation before version 2024.4.0.1 allows a local authenticated attacker to achieve local privilege escalation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/December-2024-Security-Advisory-Ivanti-Automation-CVE-2024-9845