Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-31388 State: PUBLISHED Published: 2024-04-15T10:11:48.203Z Last Updated: 2024-08-02T01:52:56.907Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Pauple Products: Table & Contact Form 7 Database – Tablesome Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Pauple Table & Contact Form 7 Database – Tablesome.This issue affects Table & Contact Form 7 Database – Tablesome: from n/a through 1.0.25. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/tablesome/wordpress-tablesome-plugin-1-0-25-cross-site-request-forgery-csrf-vul
://patchstack.com/database/vulnerability/tablesome/wordpress-tablesome-plugin-1-0-25-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2024-31389 State: PUBLISHED Published: 2024-04-15T10:10:54.291Z Last Updated: 2024-08-02T01:52:56.849Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: Ertano Products: MihanPanel Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Ertano MihanPanel.This issue affects MihanPanel: from n/a before 12.7. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/mihanpanel-lite/wordpress-mihanpanel-plugin-12-7-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2024-31390 State: PUBLISHED Published: 2024-04-03T11:39:23.926Z Last Updated: 2024-08-02T01:52:56.863Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Soflyy Products: Breakdance Problem Types: CWE-94 Description: : Improper Control of Generation of Code ('Code Injection') vulnerability in Soflyy Breakdance allows : Code Injection.This issue affects Breakdance: from n/a through 1.7.2. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/breakdance/wordpress-breakdance-plugin-1-7-0-authenticated-remote-code-execution-rce-vulnerability?_s_id=cve - https://snicco.io
ce/wordpress-breakdance-plugin-1-7-0-authenticated-remote-code-execution-rce-vulnerability?_s_id=cve - https://snicco.io/vulnerability-disclosure/breakdance/client-mode-remote-code-execution-breakdance-1-7-0?_s_id=cve - https://patchstack.com/articles/unpatched-authenticated-rce-in-oxygen-and-breakdance-builder?_s_id=cve - https://www.youtube.com/watch?v=9glx54-LfRE
CVE ID: CVE-2024-31391 State: PUBLISHED Published: 2024-04-12T15:00:26.569Z Last Updated: 2025-03-13T19:45:50.106Z Vendors: Apache Software Foundation Products: Apache Solr Operator Problem Types: CWE-532 Description: Insertion of Sensitive Information into Log File vulnerability in the Apache Solr Operator. This issue affects all versions of the Apache Solr Operator from 0.3.0 through 0.8.0. When asked to bootstrap Solr security, the operator will enable basic authentication and create several accounts for accessing Solr: including the "solr" and "admin" accounts for use by end-users, and a "k8s-oper" account which the operator uses for its own requests to Solr. One common source of these o
y end-users, and a "k8s-oper" account which the operator uses for its own requests to Solr. One common source of these operator requests is healthchecks: liveness, readiness, and startup probes are all used to determine Solr's health and ability to receive traffic. By default, the operator configures the Solr APIs used for these probes to be exempt from authentication, but users may specifically request that authentication be required on probe endpoints as well. Whenever one of these probes would fail, if authentication was in use, the Solr Operator would create a Kubernetes "event" containing the username and password of the "k8s-oper" account. Within the affected version range, this vulner
s "event" containing the username and password of the "k8s-oper" account. Within the affected version range, this vulnerability affects any solrcloud resource which (1) bootstrapped security through use of the `.solrOptions.security.authenticationType=basic` option, and (2) required authentication be used on probes by setting `.solrOptions.security.probesRequireAuth=true`. Users are recommended to upgrade to Solr Operator version 0.8.1, which fixes this issue by ensuring that probes no longer print the credentials used for Solr requests. Users may also mitigate the vulnerability by disabling authentication on their healthcheck probes using the setting `.solrOptions.security.probesRequireAuth
ility by disabling authentication on their healthcheck probes using the setting `.solrOptions.security.probesRequireAuth=false`. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lists.apache.org/thread/w7011s78lzywzwyszvy4d8zm99ybt8c7 - http://www.openwall.com/lists/oss-security/2024/04/12/7
CVE ID: CVE-2024-31392 State: PUBLISHED Published: 2024-04-03T15:19:14.608Z Last Updated: 2024-10-30T16:15:31.793Z Vendors: Mozilla Products: Firefox for iOS Problem Types: Firefox on iOS would show pages with mixed content secure Description: If an insecure element was added to a page after a delay, Firefox would not replace the secure icon with a mixed content security status This vulnerability affects Firefox for iOS < 124. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1875925 - https://www.mozilla.org/security/advisories/mfsa2024-17/
CVE ID: CVE-2024-31393 State: PUBLISHED Published: 2024-04-03T15:19:14.045Z Last Updated: 2024-11-22T20:56:34.296Z Vendors: Mozilla Products: Firefox for iOS Problem Types: Javascript URLs would load when dragged to address bar Description: Dragging Javascript URLs to the address bar could cause them to be loaded, bypassing restrictions and security protections This vulnerability affects Firefox for iOS < 124. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1879739 - https://www.mozilla.org/security/advisories/mfsa2024-17/
CVE ID: CVE-2024-31394 State: PUBLISHED Published: 2024-05-22T04:35:31.768Z Last Updated: 2025-03-27T15:03:43.986Z Vendors: appleple inc. Products: a-blog cms Ver.3.1.x series, a-blog cms Ver.3.0.x series, a-blog cms Ver.2.11.x series, a-blog cms Ver.2.10.x series, a-blog cms Problem Types: Directory traversal Description: Directory traversal vulnerability exists in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.12, Ver.3.0.x series versions prior to Ver.3.0.32, Ver.2.11.x series versions prior to Ver.2.11.61, Ver.2.10.x series versions prior to Ver.2.10.53, and Ver.2.9 and earlier versions. If this vulnerability is exploited, a user with an editor or higher privilege who can log in t
2.9 and earlier versions. If this vulnerability is exploited, a user with an editor or higher privilege who can log in to the product may obtain arbitrary files on the server. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://developer.a-blogcms.jp/blog/news/JVN-70977403.html - https://jvn.jp/en/jp/JVN70977403/
CVE ID: CVE-2024-31395 State: PUBLISHED Published: 2024-05-22T04:35:37.216Z Last Updated: 2024-10-31T14:53:49.233Z Vendors: appleple inc. Products: a-blog cms Ver.3.1.x series, a-blog cms Ver.3.0.x series, a-blog cms Ver.2.11.x series, a-blog cms Ver.2.10.x series, a-blog cms Problem Types: Cross-site scripting (XSS) Description: Cross-site scripting vulnerability exists in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.12, Ver.3.0.x series versions prior to Ver.3.0.32, Ver.2.11.x series versions prior to Ver.2.11.61, Ver.2.10.x series versions prior to Ver.2.10.53, and Ver.2.9 and earlier versions. If this vulnerability is exploited, a user with an editor or higher privilege who can
and Ver.2.9 and earlier versions. If this vulnerability is exploited, a user with an editor or higher privilege who can log in to the product may execute an arbitrary script on the web browser of the user who accessed the schedule management page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://developer.a-blogcms.jp/blog/news/JVN-70977403.html - https://jvn.jp/en/jp/JVN70977403/
CVE ID: CVE-2024-31396 State: PUBLISHED Published: 2024-05-22T04:35:42.765Z Last Updated: 2024-08-02T01:52:56.923Z Vendors: appleple inc. Products: a-blog cms Ver.3.1.x series, a-blog cms Ver.3.0.x series Problem Types: Code injection Description: Code injection vulnerability exists in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.12 and Ver.3.0.x series versions prior to Ver.3.0.32. If this vulnerability is exploited, a user with an administrator or higher privilege who can log in to the product may execute an arbitrary command on the server. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://developer.a-blogcms.jp/blog/news/JVN-7097740
es: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://developer.a-blogcms.jp/blog/news/JVN-70977403.html - https://jvn.jp/en/jp/JVN70977403/
CVE ID: CVE-2024-31397 State: PUBLISHED Published: 2024-06-11T05:34:39.924Z Last Updated: 2024-08-02T01:52:56.934Z Vendors: Cybozu, Inc. Products: Cybozu Garoon Problem Types: Improper Handling of Extra Values Description: Improper handling of extra values issue exists in Cybozu Garoon 5.0.0 to 5.15.2. If this vulnerability is exploited, a user who can log in to the product with the administrative privilege may be able to cause a denial-of-service (DoS) condition. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cs.cybozu.co.jp/2024/007901.html - https://jvn.jp/en/jp/JVN28869536/
CVE ID: CVE-2024-31398 State: PUBLISHED Published: 2024-06-11T05:20:51.967Z Last Updated: 2025-03-13T13:17:16.880Z Vendors: Cybozu, Inc. Products: Cybozu Garoon Problem Types: Insertion of Sensitive Information Into Sent Data Description: Insertion of sensitive information into sent data issue exists in Cybozu Garoon 5.0.0 to 5.15.2. If this vulnerability is exploited, a user who can log in to the product may obtain information on the list of users. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cs.cybozu.co.jp/2024/007901.html - https://jvn.jp/en/jp/JVN28869536/
CVE ID: CVE-2024-31399 State: PUBLISHED Published: 2024-06-11T05:34:34.564Z Last Updated: 2025-03-20T18:56:16.896Z Vendors: Cybozu, Inc. Products: Cybozu Garoon Problem Types: Excessive Platform Resource Consumption within a Loop Description: Excessive platform resource consumption within a loop issue exists in Cybozu Garoon 5.0.0 to 5.15.2. If this vulnerability is exploited, processing a crafted mail may cause a denial-of-service (DoS) condition. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cs.cybozu.co.jp/2024/007901.html - https://jvn.jp/en/jp/JVN28869536/
CVE ID: CVE-2024-31400 State: PUBLISHED Published: 2024-06-11T04:26:31.583Z Last Updated: 2024-11-08T21:24:53.210Z Vendors: Cybozu, Inc. Products: Cybozu Garoon Problem Types: Insertion of Sensitive Information Into Sent Data Description: Insertion of sensitive information into sent data issue exists in Cybozu Garoon 5.0.0 to 5.15.0. If this vulnerability is exploited, unintended data may be left in forwarded mail. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cs.cybozu.co.jp/2024/007901.html - https://jvn.jp/en/jp/JVN28869536/
CVE ID: CVE-2024-31401 State: PUBLISHED Published: 2024-06-11T04:26:53.806Z Last Updated: 2024-08-02T01:52:56.951Z Vendors: Cybozu, Inc. Products: Cybozu Garoon Problem Types: Cross-site scripting (XSS) Description: Cross-site scripting vulnerability in Cybozu Garoon 5.0.0 to 5.15.2 allows a remote authenticated attacker with an administrative privilege to inject an arbitrary script on the web browser of the user who is logging in to the product. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cs.cybozu.co.jp/2024/007901.html - https://jvn.jp/en/jp/JVN28869536/
CVE ID: CVE-2024-31402 State: PUBLISHED Published: 2024-06-11T05:21:04.938Z Last Updated: 2025-03-28T20:36:36.386Z Vendors: Cybozu, Inc. Products: Cybozu Garoon Problem Types: Incorrect Authorization Description: Incorrect authorization vulnerability in Cybozu Garoon 5.0.0 to 5.15.2 allows a remote authenticated attacker to delete the data of Shared To-Dos. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cs.cybozu.co.jp/2024/007901.html - https://jvn.jp/en/jp/JVN28869536/
CVE ID: CVE-2024-31403 State: PUBLISHED Published: 2024-06-11T04:27:01.971Z Last Updated: 2024-08-02T01:52:56.908Z Vendors: Cybozu, Inc. Products: Cybozu Garoon Problem Types: Incorrect Authorization Description: Incorrect authorization vulnerability in Cybozu Garoon 5.0.0 to 6.0.0 allows a remote authenticated attacker to alter and/or obtain the data of Memo. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cs.cybozu.co.jp/2024/007901.html - https://jvn.jp/en/jp/JVN28869536/
CVE ID: CVE-2024-31404 State: PUBLISHED Published: 2024-06-11T04:27:07.608Z Last Updated: 2024-11-21T19:00:13.374Z Vendors: Cybozu, Inc. Products: Cybozu Garoon Problem Types: Insertion of Sensitive Information Into Sent Data Description: Insertion of sensitive information into sent data issue exists in Cybozu Garoon 5.5.0 to 6.0.0, which may allow a user who can log in to the product to view the data of Scheduler. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cs.cybozu.co.jp/2024/007901.html - https://jvn.jp/en/jp/JVN28869536/
CVE ID: CVE-2024-31405 State: REJECTED Published: N/A Last Updated: 2025-11-20T15:53:15.592Z Description: No description available.
CVE ID: CVE-2024-31406 State: PUBLISHED Published: 2024-04-24T05:45:37.291Z Last Updated: 2024-08-02T01:52:56.862Z Vendors: RoamWiFi Technology Co., Ltd. Products: RoamWiFi R10 Problem Types: Active debug code Description: Active debug code vulnerability exists in RoamWiFi R10 prior to 4.8.45. If this vulnerability is exploited, a network-adjacent unauthenticated attacker with access to the device may perform unauthorized operations. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.roamwifi.hk/product.jsp - https://jvn.jp/en/jp/JVN62737544/
CVE ID: CVE-2024-31407 State: PUBLISHED Published: 2024-11-13T21:08:20.386Z Last Updated: 2024-11-14T19:45:06.468Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) High Level Synthesis Compiler software for Intel(R) Quartus(R) Prime Pro Edition Software Problem Types: escalation of privilege, CWE-427 Description: Uncontrolled search path in some Intel(R) High Level Synthesis Compiler software for Intel(R) Quartus(R) Prime Pro Edition Software before version 24.1 may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.inte
alation of privilege via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01148.html
CVE ID: CVE-2024-31408 State: PUBLISHED Published: 2024-11-22T00:10:50.954Z Last Updated: 2024-12-05T20:44:27.398Z Severity: HIGH (CVSS 8 CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: AIPHONE CO., LTD. Products: IX-MV, IX-MV7-HB, IX-MV7-HBT, IX-MV7-HW, IX-MV7-HWT, IX-MV7-HW-JP, IX-MV7-B, IX-MV7-BT, IX-MV7-W, IX-MV7-WT, IX-DA, IX-DAU, IX-DB, IX-DBT, IX-EA, IX-EAT, IX-EAU, IX-DV, IX-DVT, IX-DVF, IX-DVF-P, IX-DVF-L, IX-DVM, IX-DU, IX-DVF-RA, IX-DVF-2RA, IX-BA, IX-BAU, IX-BB, IX-BBT, IX-FA, IX-SSA, IX-SS-2G, IX-SS-2GT, IX-SS-2G-N, IX-BU, IX-SSA-RA, IX-SSA-2RA, IX-RS-B, IX-RS-BT, IX-RS-W, IX-RS-WT, IXW-MA, IX-SPMIC, IXG-2C7, IXG-2C7-L, IXG-DM7, IXG-DM7-HID, IXG-DM7-HIDA, IXG-DM7-10K, IXG
IX-RS-BT, IX-RS-W, IX-RS-WT, IXW-MA, IX-SPMIC, IXG-2C7, IXG-2C7-L, IXG-DM7, IXG-DM7-HID, IXG-DM7-HIDA, IXG-DM7-10K, IXG-MK, IXGW-GW, IXGW-TGW, IXGW-LC Problem Types: CWE-78 Description: OS command injection vulnerability exists in AIPHONE IX SYSTEM and IXG SYSTEM. A network-adjacent authenticated attacker may execute an arbitrary OS command with root privileges by sending a specially crafted request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.aiphone.net/important/20241016_1/ - https://www.aiphone.net/important/20241016_2/ - https://www.aiphone.net/support/software-documents/ix/ - https://www.aiphone.net/support/software-documents/ixg/ - https://jvn.jp/en/j
phone.net/support/software-documents/ix/ - https://www.aiphone.net/support/software-documents/ixg/ - https://jvn.jp/en/jp/JVN41397971/
CVE ID: CVE-2024-31409 State: PUBLISHED Published: 2024-05-15T20:00:22.532Z Last Updated: 2025-08-07T18:26:54.578Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: CyberPower Products: PowerPanel business Problem Types: CWE-863 Description: Certain MQTT wildcards are not blocked on the CyberPower PowerPanel system, which might result in an attacker obtaining data from throughout the system after gaining access to any device. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-123-01 - https://www.cyberpower.com/global/en/product/sku/powerpanel_business_for_windows#do
ents/ics-advisories/icsa-24-123-01 - https://www.cyberpower.com/global/en/product/sku/powerpanel_business_for_windows#downloads
CVE ID: CVE-2024-31410 State: PUBLISHED Published: 2024-05-15T19:56:00.616Z Last Updated: 2024-08-02T01:52:56.912Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N) Vendors: CyberPower Products: PowerPanel business Problem Types: CWE-321 Description: The devices which CyberPower PowerPanel manages use identical certificates based on a hard-coded cryptographic key. This can allow an attacker to impersonate any client in the system and send malicious data. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-123-01 - https://www.cyberpower.com/global/en/product/sku/powerpanel_busin
w.cisa.gov/news-events/ics-advisories/icsa-24-123-01 - https://www.cyberpower.com/global/en/product/sku/powerpanel_business_for_windows#downloads
CVE ID: CVE-2024-31411 State: PUBLISHED Published: 2024-07-17T09:22:08.507Z Last Updated: 2024-09-13T17:04:42.752Z Vendors: Apache Software Foundation Products: Apache StreamPipes Problem Types: CWE-434 Description: Unrestricted Upload of File with dangerous type vulnerability in Apache StreamPipes. Such a dangerous type might be an executable file that may lead to a remote code execution (RCE). The unrestricted upload is only possible for authenticated and authorized users. This issue affects Apache StreamPipes: through 0.93.0. Users are recommended to upgrade to version 0.95.0, which fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: -
.95.0, which fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lists.apache.org/thread/b0657okbwzg5xxs11hphvc9qrd9s70mt
CVE ID: CVE-2024-31412 State: PUBLISHED Published: 2024-05-01T12:52:13.173Z Last Updated: 2024-08-02T01:52:56.842Z Vendors: OMRON Corporation Products: CX-Programmer Problem Types: Out-of-bounds read Description: Out-of-bounds read vulnerability exists in CX-Programmer included in CX-One CXONE-AL[][]D-V4 Ver. 9.81 or lower. Opening a specially crafted project file may lead to information disclosure and/or the product being crashed. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.fa.omron.co.jp/product/security/assets/pdf/en/OMSR-2024-003_en.pdf - https://jvn.jp/en/vu/JVNVU98274902/
CVE ID: CVE-2024-31413 State: PUBLISHED Published: 2024-05-01T12:54:15.483Z Last Updated: 2025-03-14T14:51:31.055Z Vendors: OMRON Corporation Products: CX-One CX-One CXONE-AL[][]D-V4 , Sysmac Studio SYSMAC-SE2[][][] Problem Types: Free of pointer not at start of buffer Description: Free of pointer not at start of buffer vulnerability exists in CX-One CX-One CXONE-AL[][]D-V4 (The version which was installed with a DVD ver. 4.61.1 or lower, and was updated through CX-One V4 auto update in January 2024 or prior) and Sysmac Studio SYSMAC-SE2[][][] (The version which was installed with a DVD ver. 1.56 or lower, and was updated through Sysmac Studio V1 auto update in January 2024 or prior). Openin
ed with a DVD ver. 1.56 or lower, and was updated through Sysmac Studio V1 auto update in January 2024 or prior). Opening a specially crafted project file may lead to arbitrary code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.fa.omron.co.jp/product/security/assets/pdf/en/OMSR-2024-002_en.pdf - https://jvn.jp/en/vu/JVNVU98274902/
CVE ID: CVE-2024-31414 State: PUBLISHED Published: 2024-09-13T16:46:51.010Z Last Updated: 2024-09-13T17:35:46.770Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Eaton Products: Foreseer Problem Types: CWE-79 Description: The Eaton Foreseer software provides users the capability to customize the dashboard in WebView pages. However, the input fields for this feature in the Eaton Foreseer software lacked proper input sanitization on the server-side, which could lead to injection and execution of malicious scripts when abused by bad actors. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.eaton.com/content/dam/eaton/company/news-ins
dditional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/etn-va-2024-1008.pdf
CVE ID: CVE-2024-31415 State: PUBLISHED Published: 2024-09-13T16:48:12.280Z Last Updated: 2025-08-26T10:22:22.285Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L) Vendors: Eaton Products: Foreseer Problem Types: CWE-312 Description: The Eaton Foreseer software provides the feasibility for the user to configure external servers for multiple purposes such as network management, user management, etc. The software uses encryption to store these configurations securely on the host machine. However, the keys used for this encryption were insecurely stored, which could be abused to possibly change or remove the server configuration. Additional Analyst Notes: - CISA ADP Vuln
, which could be abused to possibly change or remove the server configuration. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/etn-va-2024-1008.pdf
CVE ID: CVE-2024-31416 State: PUBLISHED Published: 2024-09-13T16:48:32.815Z Last Updated: 2025-08-26T10:24:06.959Z Severity: MEDIUM (CVSS 5.6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:L) Vendors: Eaton Products: Foreseer Problem Types: CWE-190 Description: The Eaton Foreseer software provides multiple customizable input fields for the users to configure parameters in the tool like alarms, reports, etc. Some of these input fields were not checking the length and bounds of the entered value. The exploit of this security flaw by a bad actor may result in excessive memory consumption or integer overflow. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.eaton.com/cont
umption or integer overflow. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/etn-va-2024-1008.pdf