Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-8296 State: PUBLISHED Published: 2024-08-29T12:31:09.543Z Last Updated: 2024-08-29T13:26:01.176Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: n/a Products: FeehiCMS Problem Types: CWE-434 Description: A vulnerability was found in FeehiCMS up to 2.1.1 and classified as critical. This issue affects the function insert of the file /admin/index.php?r=user%2Fcreate. The manipulation of the argument User[avatar] leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP
he vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.276071 - https://vuldb.com/?ctiid.276071 - https://vuldb.com/?submit.394568 - https://gitee.com/A0kooo/cve_article/blob/master/feehi_cms/file_upload3/Fichkems%20user%20file%20upload%20vulnerability.md
CVE ID: CVE-2024-8297 State: PUBLISHED Published: 2024-08-29T12:31:11.351Z Last Updated: 2024-08-29T13:11:08.916Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: kitsada8621 Products: Digital Library Management System Problem Types: CWE-117 Description: A vulnerability was found in kitsada8621 Digital Library Management System 1.0. It has been classified as problematic. Affected is the function JwtRefreshAuth of the file middleware/jwt_refresh_token_middleware.go. The manipulation of the argument Authorization leads to improper output neutralization for logs. It is possible to launch the attack remotely. The name of the patch is 81b3336b4c9240f0bf50c13cb8375
alization for logs. It is possible to launch the attack remotely. The name of the patch is 81b3336b4c9240f0bf50c13cb8375cf860d945f1. It is recommended to apply a patch to fix this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.276072 - https://vuldb.com/?ctiid.276072 - https://vuldb.com/?submit.394613 - https://github.com/kitsada8621/Digital-Library-Management-System/issues/1 - https://github.com/kitsada8621/Digital-Library-Management-System/commit/81b3336b4c9240f0bf50c13cb8375cf860d945f1
CVE ID: CVE-2024-8298 State: PUBLISHED Published: 2024-09-04T02:22:15.826Z Last Updated: 2024-09-04T13:07:09.553Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Huawei Products: HarmonyOS, EMUI Problem Types: CWE-701 Description: Memory request vulnerability in the memory management module Impact: Successful exploitation of this vulnerability may affect service confidentiality. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://https://consumer.huawei.com/en/support/bulletin/2024/9/
CVE ID: CVE-2024-8299 State: PUBLISHED Published: 2024-11-28T22:16:31.396Z Last Updated: 2024-12-06T05:18:03.652Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Mitsubishi Electric Corporation, ICONICS Products: GENESIS64, MC Works64 Problem Types: CWE-427 Description: Uncontrolled Search Path Element vulnerability in ICONICS GENESIS64 all versions, Mitsubishi Electric GENESIS64 all versions and Mitsubishi Electric MC Works64 all versions allows a local authenticated attacker to execute a malicious code by storing a specially crafted DLL in a specific folder. This could lead to disclose, tamper with, destroy, or delete information in the affected products, or
a specific folder. This could lead to disclose, tamper with, destroy, or delete information in the affected products, or cause a denial of service (DoS) condition on the products. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2024-010_en.pdf - https://jvn.jp/vu/JVNVU93891820 - https://www.cisa.gov/news-events/ics-advisories/icsa-24-338-04
CVE ID: CVE-2024-8300 State: PUBLISHED Published: 2024-11-28T22:18:28.358Z Last Updated: 2024-12-06T05:21:38.917Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Mitsubishi Electric Corporation, ICONICS Products: GENESIS64 Problem Types: CWE-561 Description: Dead Code vulnerability in ICONICS GENESIS64 Version 10.97.2, 10.97.2 CFR1, 10.97.2 CRF2 and 10.97.3 and Mitsubishi Electric GENESIS64 Version 10.97.2, 10.97.2 CFR1, 10.97.2 CRF2 and 10.97.3 allows a local authenticated attacker to execute a malicious code by tampering with a specially crafted DLL. This could lead to disclose, tamper with, destroy, or delete information in the affected products, or cause a d
ted DLL. This could lead to disclose, tamper with, destroy, or delete information in the affected products, or cause a denial of service (DoS) condition on the products. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2024-010_en.pdf - https://jvn.jp/vu/JVNVU93891820 - https://www.cisa.gov/news-events/ics-advisories/icsa-24-338-04
CVE ID: CVE-2024-8301 State: PUBLISHED Published: 2024-08-29T13:00:05.967Z Last Updated: 2024-08-29T13:22:22.236Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: dingfanzu Products: CMS Problem Types: CWE-89 Description: A vulnerability was found in dingfanzu CMS up to 29d67d9044f6f93378e6eb6ff92272217ff7225c. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /ajax/checkin.php. The manipulation of the argument username leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Th
ed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.276073 - https://vuldb.com/?ctiid.276073 - https://vuldb.com/?submit.396294 - https://github.com/Xor-Gerke/webray.com.cn/blob/main/cve/dingfanzu-CMS/dingfanzu-CMS%20checkin.php%20username%20SQL-inject.md
CVE ID: CVE-2024-8302 State: PUBLISHED Published: 2024-08-29T14:00:06.289Z Last Updated: 2024-08-29T14:31:48.285Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: dingfanzu Products: CMS Problem Types: CWE-89 Description: A vulnerability was found in dingfanzu CMS up to 29d67d9044f6f93378e6eb6ff92272217ff7225c. It has been rated as critical. Affected by this issue is some unknown functionality of the file /ajax/chpwd.php. The manipulation of the argument username leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details
ublic and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.276074 - https://vuldb.com/?ctiid.276074 - https://vuldb.com/?submit.396297 - https://github.com/Xor-Gerke/webray.com.cn/blob/main/cve/dingfanzu-CMS/dingfanzu-CMS%20chpwd.php%20username%20SQL-inject.md
CVE ID: CVE-2024-8303 State: PUBLISHED Published: 2024-08-29T14:31:04.023Z Last Updated: 2024-08-29T15:45:20.745Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: dingfanzu Products: CMS Problem Types: CWE-89 Description: A vulnerability classified as critical has been found in dingfanzu CMS up to 29d67d9044f6f93378e6eb6ff92272217ff7225c. This affects an unknown part of the file /ajax/getBasicInfo.php. The manipulation of the argument username leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are u
may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.276075 - https://vuldb.com/?ctiid.276075 - https://vuldb.com/?submit.396298 - https://github.com/Xor-Gerke/webray.com.cn/blob/main/cve/dingfanzu-CMS/dingfanzu-CMS%20getBasicInfo.php%20username%20SQL-inject.md
CVE ID: CVE-2024-8304 State: PUBLISHED Published: 2024-08-29T14:31:05.547Z Last Updated: 2024-08-29T15:43:47.485Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: n/a Products: jpress Problem Types: CWE-22 Description: A vulnerability has been found in jpress up to 5.1.1 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/template/edit of the component Template Module Handler. The manipulation leads to path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.276079 - https://vuldb.com
used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.276079 - https://vuldb.com/?ctiid.276079 - https://vuldb.com/?submit.396425 - https://github.com/JPressProjects/jpress/issues/189
CVE ID: CVE-2024-8305 State: PUBLISHED Published: 2024-10-21T14:10:31.079Z Last Updated: 2024-10-21T15:50:06.751Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: MongoDB Inc Products: MongoDB Server Problem Types: CWE-1288 Description: prepareUnique index may cause secondaries to crash due to incorrect enforcement of index constraints on secondaries, where in extreme cases may cause multiple secondaries crashing leading to no primaries. This issue affects MongoDB Server v6.0 versions prior to 6.0.17, MongoDB Server v7.0 versions prior to 7.0.13 and MongoDB Server v7.3 versions prior to 7.3.4 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - ht
0.13 and MongoDB Server v7.3 versions prior to 7.3.4 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://jira.mongodb.org/browse/SERVER-92382
CVE ID: CVE-2024-8306 State: PUBLISHED Published: 2024-09-11T15:05:31.560Z Last Updated: 2024-09-11T18:21:20.415Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Schneider Electric Products: Vijeo Designer, Vijeo Designer embedded in EcoStruxure™ Machine Expert Problem Types: CWE-269 Description: CWE-269: Improper Privilege Management vulnerability exists that could cause unauthorized access, loss of confidentiality, integrity and availability of the workstation when non-admin authenticated user tries to perform privilege escalation by tampering with the binaries. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://download.schneider-elect
ing with the binaries. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-254-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-254-01.pdf
CVE ID: CVE-2024-8308 State: PUBLISHED Published: 2024-11-28T10:21:43.190Z Last Updated: 2024-11-29T19:07:16.321Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Siempelkamp Products: UmweltOffice Problem Types: CWE-89 Description: A low privileged remote attacker can insert a SQL injection in the web application due to improper handling of HTTP request input data which allows to exfiltrate all data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.syss.de/pentest-blog/sql-injection-in-siempelkamp-nis-umweltoffice
CVE ID: CVE-2024-8309 State: PUBLISHED Published: 2024-10-29T12:50:13.198Z Last Updated: 2025-10-15T12:50:40.456Z Severity: MEDIUM (CVSS 4.9 CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: langchain-ai Products: langchain-ai/langchain Problem Types: CWE-89 Description: A vulnerability in the GraphCypherQAChain class of langchain-ai/langchain version 0.2.5 allows for SQL injection through prompt injection. This vulnerability can lead to unauthorized data manipulation, data exfiltration, denial of service (DoS) by deleting all data, breaches in multi-tenant security environments, and data integrity issues. Attackers can create, update, or delete nodes and relationships without proper au
vironments, and data integrity issues. Attackers can create, update, or delete nodes and relationships without proper authorization, extract sensitive data, disrupt services, access data across different tenants, and compromise the integrity of the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/8f4ad910-7fdc-4089-8f0a-b5df5f32e7c5 - https://github.com/langchain-ai/langchain/commit/c2a3021bb0c5f54649d380b42a0684ca5778c255
CVE ID: CVE-2024-8310 State: PUBLISHED Published: 2024-09-27T16:33:39.522Z Last Updated: 2024-09-27T19:19:33.579Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: OPW Fuel Managements Systems Products: SiteSentinel Problem Types: CWE-306 Description: OPW Fuel Management Systems SiteSentinel could allow an attacker to bypass authentication to the server and obtain full admin privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-268-01
CVE ID: CVE-2024-8311 State: PUBLISHED Published: 2024-09-12T18:27:24.446Z Last Updated: 2024-09-13T14:17:38.422Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-424 Description: An issue was discovered with pipeline execution policies in GitLab EE affecting all versions from 17.2 prior to 17.2.5, 17.3 prior to 17.3.2 which allows authenticated users to bypass variable overwrite protection via inclusion of a CI/CD template. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/479315
CVE ID: CVE-2024-8312 State: PUBLISHED Published: 2024-10-24T09:30:43.270Z Last Updated: 2024-10-24T12:57:20.551Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-79 Description: An issue has been discovered in GitLab CE/EE affecting all versions from 15.10 before 17.3.6, 17.4 before 17.4.3, and 17.5 before 17.5.1. An attacker could inject HTML into the Global Search field on a diff view leading to XSS. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/481819 - https://hackerone.com/reports/2659386
CVE ID: CVE-2024-8313 State: PUBLISHED Published: 2025-03-25T04:29:15.452Z Last Updated: 2025-03-25T13:37:29.425Z Vendors: B&R Industrial Automation GmbH Products: APROL Problem Types: CWE-497, CWE-1188 Description: An Exposure of Sensitive System Information to an Unauthorized Control Sphere and Initialization of a Resource with an Insecure Default vulnerability in the SNMP component of B&R APROL <4.4-00P5 may allow an unauthenticated adjacent-based attacker to read and alter configuration using SNMP. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.br-automation.com/fileadmin/SA24P015-77573c08.pdf
CVE ID: CVE-2024-8314 State: PUBLISHED Published: 2025-03-25T04:30:17.669Z Last Updated: 2025-03-25T13:34:31.280Z Vendors: B&R Industrial Automation GmbH Products: APROL Problem Types: CWE-303, CWE-488 Description: An Incorrect Implementation of Authentication Algorithm and Exposure of Data Element to Wrong Ses-sion vulnerability in the session handling used in B&R APROL <4.4-00P5 may allow an authenticated network attacker to take over a currently active user session without login credentials. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.br-automation.com/fileadmin/SA24P015-77573c08.pdf
CVE ID: CVE-2024-8315 State: PUBLISHED Published: 2025-03-25T04:31:27.667Z Last Updated: 2025-03-25T13:22:20.976Z Vendors: B&R Industrial Automation Products: B&R APROL Problem Types: CWE-280 Description: An Improper Handling of Insufficient Permissions or Privileges vulnerability in scripts used in B&R APROL <4.4-00P5 may allow an authenticated local attacker to read credential information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.br-automation.com/fileadmin/SA24P015-77573c08.pdf
CVE ID: CVE-2024-8316 State: PUBLISHED Published: 2024-09-25T13:59:20.369Z Last Updated: 2024-09-25T14:16:14.295Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Progress Software Products: Telerik UI for WPF Problem Types: CWE-502 Description: In Progress Telerik UI for WPF versions prior to 2024 Q3 (2024.3.924), a code execution attack is possible through an insecure deserialization vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.telerik.com/devtools/wpf/knowledge-base/unsafe-deserialization-cve-2024-8316
CVE ID: CVE-2024-8317 State: PUBLISHED Published: 2024-09-06T06:50:53.437Z Last Updated: 2024-09-06T13:29:09.867Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wpeka-club Products: WP AdCenter – Ad Manager & Adsense Ads Problem Types: CWE-79 Description: The WP AdCenter – Ad Manager & Adsense Ads plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ad_alignment’ attribute in all versions up to, and including, 2.5.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a
tackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ac7f95c7-2159-4327-ba09-da7721f1312e?source=cve - https://plugins.trac.wordpress.org/browser/wpadcenter/trunk/admin/class-wpadcenter-admin.php#L2922 - https://wordpress.org/plugins/wpadcenter/#developers - https://plugins.trac.wordpress.org/browser/wpadcenter/trunk/admin/class-wpadcenter-admin.php#L3020 - https://plugins.trac.wordpress.org/browser/wpadcenter/trunk/admin/class-wpadcenter-admin.php#L3127 - https://plugins.t
- https://plugins.trac.wordpress.org/browser/wpadcenter/trunk/admin/class-wpadcenter-admin.php#L3127 - https://plugins.trac.wordpress.org/changeset/3146736/#file6 - https://plugins.trac.wordpress.org/changeset/3146736/
CVE ID: CVE-2024-8318 State: PUBLISHED Published: 2024-09-04T07:31:28.854Z Last Updated: 2024-09-04T13:16:11.071Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: websevendev Products: Attributes for Blocks Problem Types: CWE-79 Description: The Attributes for Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘attributesForBlocks’ parameter in all versions up to, and including, 1.0.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected
level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a0101dd1-a9cb-4b9c-8299-9b808d7e1912?source=cve - https://plugins.trac.wordpress.org/browser/attributes-for-blocks/trunk/attributes-for-blocks.php#L246 - https://wordpress.org/plugins/attributes-for-blocks/#developers - https://plugins.trac.wordpress.org/browser/attributes-for-blocks/trunk/attributes-for-blocks.php#L96 - https://plugins.trac.wordpress.org/changeset?old_path=%2Fattributes-for-blocks&old=3066420&new_path=%2Fattributes-for-blocks&new
plugins.trac.wordpress.org/changeset?old_path=%2Fattributes-for-blocks&old=3066420&new_path=%2Fattributes-for-blocks&new=3144730&sfp_email=&sfph_mail=
CVE ID: CVE-2024-8319 State: PUBLISHED Published: 2024-08-30T07:33:09.622Z Last Updated: 2024-08-30T14:49:44.538Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: themefic Products: Tourfic – Ultimate Hotel Booking, Travel Booking & Apartment Booking WordPress Plugin | WooCommerce Booking Problem Types: CWE-352 Description: The Tourfic plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.11.20. This is due to missing or incorrect nonce validation on the tf_order_status_email_resend_function, tf_visitor_details_edit_function, tf_checkinout_details_edit_function, tf_order_status_edit_function, tf_order_bulk_ac
, tf_visitor_details_edit_function, tf_checkinout_details_edit_function, tf_order_status_edit_function, tf_order_bulk_action_edit_function, tf_remove_room_order_ids, and tf_delete_old_review_fields functions. This makes it possible for unauthenticated attackers to resend order status emails, update visitor/order details, edit check-in/out details, edit order status, perform bulk order status updates, remove room order IDs, and delete old review fields, respectively, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulner
n a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/07fa7b1a-9137-4049-a20a-8eb6df7ca578?source=cve - https://plugins.trac.wordpress.org/changeset/3054266/tourfic
CVE ID: CVE-2024-8320 State: PUBLISHED Published: 2024-09-10T20:52:31.146Z Last Updated: 2024-09-11T15:19:03.245Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: Ivanti Products: Endpoint Manager Problem Types: CWE-306 Description: Missing authentication in Network Isolation of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to spoof Network Isolation status of managed devices. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-EPM-September-2024-for-EPM-2024-and-EPM-2022
CVE ID: CVE-2024-8321 State: PUBLISHED Published: 2024-09-10T20:54:02.772Z Last Updated: 2024-09-11T15:20:28.646Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L) Vendors: Ivanti Products: Endpoint Manager Problem Types: CWE-306 Description: Missing authentication in Network Isolation of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to isolate managed devices from the network. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-EPM-September-2024-for-EPM-2024-and-EPM-2022
CVE ID: CVE-2024-8322 State: PUBLISHED Published: 2024-09-10T20:59:40.339Z Last Updated: 2024-09-11T13:50:36.958Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Ivanti Products: Endpoint Manager Problem Types: CWE-1390 Description: Weak authentication in Patch Management of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker to access restricted functionality. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-EPM-September-2024-for-EPM-2024-and-EPM-2022