Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
s` commands could execute arbitrary code on the user's workstation if the remote username contains something like `-oProxyCommand="echo hacked" #`. The `-oProxyCommand` flag causes `ssh` to execute the provided command while `#` shell comment causes any other `ssh` arguments to be ignored. In `2.62.0`, the remote username information is being validated before being used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/cli/cli/security/advisories/GHSA-p2h2-3vg9-4p87
CVE ID: CVE-2024-52309 State: PUBLISHED Published: 2024-11-21T17:11:06.556Z Last Updated: 2024-11-21T20:40:32.988Z Vendors: drakkan Products: sftpgo Problem Types: CWE-20 Description: SFTPGo is a full-featured and highly configurable SFTP, HTTP/S, FTP/S and WebDAV server - S3, Google Cloud Storage, Azure Blob. One powerful feature of SFTPGo is the ability to have the EventManager execute scripts or run applications in response to certain events. This feature is very common in all software similar to SFTPGo and is generally unrestricted. However, any SFTPGo administrator with permission to run a script has access to the underlying OS/container with the same permissions as the user running SFT
h permission to run a script has access to the underlying OS/container with the same permissions as the user running SFTPGo. This is unexpected for some SFTPGo administrators who think that there is a clear distinction between accessing the system shell and accessing the SFTPGo WebAdmin UI. To avoid this confusion, running system commands is disabled by default in 2.6.3, and an allow list has been added so that system administrators configuring SFTPGo must explicitly define which commands are allowed to be configured from the WebAdmin UI. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/drakkan/sftpgo/security/advisories/GHSA-49cc-xrjf-9qf7 - https://github
P Vulnrichment: References: - https://github.com/drakkan/sftpgo/security/advisories/GHSA-49cc-xrjf-9qf7 - https://github.com/drakkan/sftpgo/commit/88b1850b5806eee81150873d4e565144b21021fb - https://github.com/drakkan/sftpgo/commit/b524da11e9466d05fe03304713ee1c61bb276ec4
CVE ID: CVE-2024-52311 State: PUBLISHED Published: 2024-11-09T00:42:49.246Z Last Updated: 2025-10-14T19:25:04.120Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: amazon Products: data.all Problem Types: CWE-613 Description: Authentication tokens issued via Cognito in data.all are not invalidated on log out, allowing for previously authenticated user to continue execution of authorized API Requests until token is expired. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://aws.amazon.com/security/security-bulletins/AWS-2024-013 - https://github.com/data-dot-all/dataall/security/advisories/GHSA-p69m-h9rw-584v - https://github.com/data-dot
2024-013 - https://github.com/data-dot-all/dataall/security/advisories/GHSA-p69m-h9rw-584v - https://github.com/data-dot-all/dataall/releases/tag/v2.6.1
CVE ID: CVE-2024-52312 State: PUBLISHED Published: 2024-11-09T00:43:04.986Z Last Updated: 2025-10-14T19:02:40.936Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: amazon Products: data.all Problem Types: CWE-863 Description: Due to inconsistent authorization permissions, data.all may allow an external actor with an authenticated account to perform restricted operations against DataSets and Environments. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://aws.amazon.com/security/security-bulletins/AWS-2024-013 - https://github.com/data-dot-all/dataall/security/advisories/GHSA-676j-g6g5-chj9 - https://github.com/data-dot-all/dataall/releas
github.com/data-dot-all/dataall/security/advisories/GHSA-676j-g6g5-chj9 - https://github.com/data-dot-all/dataall/releases/tag/v2.6.1
CVE ID: CVE-2024-52313 State: PUBLISHED Published: 2024-11-09T00:43:00.250Z Last Updated: 2025-10-14T19:26:56.176Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: amazon Products: data.all Problem Types: CWE-639 Description: An authenticated data.all user is able to manipulate a getDataset query to fetch additional information regarding the parent Environment resource that the user otherwise would not able to fetch by directly querying the object via getEnvironment in data.all. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://aws.amazon.com/security/security-bulletins/AWS-2024-013 - https://github.com/data-dot-all/dataall/security/adv
- https://aws.amazon.com/security/security-bulletins/AWS-2024-013 - https://github.com/data-dot-all/dataall/security/advisories/GHSA-hx8q-7wxv-6c7c - https://github.com/data-dot-all/dataall/releases/tag/v2.6.1
CVE ID: CVE-2024-52314 State: PUBLISHED Published: 2024-11-09T00:43:10.397Z Last Updated: 2025-10-14T19:01:19.396Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: amazon Products: data.all Problem Types: CWE-863 Description: A data.all admin team member who has access to the customer-owned AWS Account where data.all is deployed may be able to extract user data from data.all application logs in data.all via CloudWatch log scanning for particular operations that interact with customer producer teams data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://aws.amazon.com/security/security-bulletins/AWS-2024-013 - https://github.com/data-do
Vulnrichment: References: - https://aws.amazon.com/security/security-bulletins/AWS-2024-013 - https://github.com/data-dot-all/dataall/security/advisories/GHSA-p2h8-r28g-5q6h - https://github.com/data-dot-all/dataall/releases/tag/v2.6.1
CVE ID: CVE-2024-52316 State: PUBLISHED Published: 2024-11-18T11:32:22.072Z Last Updated: 2025-11-04T15:59:51.152Z Vendors: Apache Software Foundation Products: Apache Tomcat Problem Types: CWE-391 Description: Unchecked Error Condition vulnerability in Apache Tomcat. If Tomcat is configured to use a custom Jakarta Authentication (formerly JASPIC) ServerAuthContext component which may throw an exception during the authentication process without explicitly setting an HTTP status to indicate failure, the authentication may not fail, allowing the user to bypass the authentication process. There are no known Jakarta Authentication components that behave in this way. This issue affects Apache Tom
ion process. There are no known Jakarta Authentication components that behave in this way. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M26, from 10.1.0-M1 through 10.1.30, from 9.0.0-M1 through 9.0.95. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other EOL versions may also be affected. Users are recommended to upgrade to version 11.0.0, 10.1.31 or 9.0.96, which fix the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lists.apache.org/thread/lopzlqh91jj9n334g02om08sbysdb928
CVE ID: CVE-2024-52317 State: PUBLISHED Published: 2024-11-18T11:36:51.963Z Last Updated: 2025-01-24T20:03:10.485Z Vendors: Apache Software Foundation Products: Apache Tomcat Problem Types: Incorrect object re-cycling and re-use Description: Incorrect object re-cycling and re-use vulnerability in Apache Tomcat. Incorrect recycling of the request and response used by HTTP/2 requests could lead to request and/or response mix-up between users. This issue affects Apache Tomcat: from 11.0.0-M23 through 11.0.0-M26, from 10.1.27 through 10.1.30, from 9.0.92 through 9.0.95. Users are recommended to upgrade to version 11.0.0, 10.1.31 or 9.0.96, which fixes the issue. Additional Analyst Notes: - CISA
re recommended to upgrade to version 11.0.0, 10.1.31 or 9.0.96, which fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lists.apache.org/thread/ty376mrxy1mmxtw3ogo53nc9l3co3dfs
CVE ID: CVE-2024-52318 State: PUBLISHED Published: 2024-11-18T12:21:39.170Z Last Updated: 2025-01-31T15:02:49.374Z Vendors: Apache Software Foundation Products: Apache Tomcat Problem Types: Incorrect object recycling and reuse Description: Incorrect object recycling and reuse vulnerability in Apache Tomcat. This issue affects Apache Tomcat: 11.0.0, 10.1.31, 9.0.96. Users are recommended to upgrade to version 11.0.1, 10.1.32 or 9.0.97, which fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lists.apache.org/thread/co243cw1nlh6p521c5265cm839wkqdp9
CVE ID: CVE-2024-52319 State: PUBLISHED Published: 2025-01-11T12:35:39.280Z Last Updated: 2025-05-04T09:51:20.623Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: mm: use aligned address in clear_gigantic_page() In current kernel, hugetlb_no_page() calls folio_zero_user() with the fault address. Where the fault address may be not aligned with the huge page size. Then, folio_zero_user() may call clear_gigantic_page() with the address, while clear_gigantic_page() requires the address to be huge page size aligned. So, this may cause memory corruption or information leak, addtional, use more obvious naming 'addr_hint' instead of 'ad
So, this may cause memory corruption or information leak, addtional, use more obvious naming 'addr_hint' instead of 'addr' for clear_gigantic_page(). References: - https://git.kernel.org/stable/c/b79b6fe0737f233f0be1465052b7f0e75f324735 - https://git.kernel.org/stable/c/8aca2bc96c833ba695ede7a45ad7784c836a262e
CVE ID: CVE-2024-52320 State: PUBLISHED Published: 2024-12-06T17:21:44.801Z Last Updated: 2024-12-06T20:44:38.458Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Planet Technology Products: Planet WGS-804HPT Problem Types: CWE-78 Description: The affected product is vulnerable to a command injection. An unauthenticated attacker could send commands through a malicious HTTP request which could result in remote code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-340-02 - https://www.planet.com.tw/en/support/downloads?method=keyword&keyword=v1.305b241111
CVE ID: CVE-2024-52321 State: PUBLISHED Published: 2024-12-23T00:18:08.358Z Last Updated: 2024-12-24T00:39:30.331Z Severity: MEDIUM (CVSS 5.9 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Sharp Corporation Products: home 5G HR02, Wi-Fi STATION SH-52B, Wi-Fi STATION SH-54C, Wi-Fi STATION SH-05L, PocketWifi 809SH, Speed Wi-Fi NEXT W07 Problem Types: CWE-497 Description: Multiple SHARP routers contain an improper authentication vulnerability in the configuration backup function. The product's backup files containing sensitive information may be retrieved by a remote unauthenticated attacker. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://k-tai.sharp.co.jp/supp
nauthenticated attacker. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://k-tai.sharp.co.jp/support/info/info083.html - https://jvn.jp/en/jp/JVN61635834/
CVE ID: CVE-2024-52322 State: PUBLISHED Published: 2025-04-05T16:19:16.490Z Last Updated: 2025-09-05T13:18:07.029Z Vendors: LOCALSHOP Products: WebService::Xero Problem Types: CWE-338, CWE-331 Description: WebService::Xero 0.11 and earlier for Perl uses the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions. Specifically WebService::Xero uses the Data::Random library which specifically states that it is "Useful mostly for test programs". Data::Random uses the rand() function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://perldoc.perl.org/functions/rand - https://security.metacpan.org/docs/guides/rand
ADP Vulnrichment: References: - https://perldoc.perl.org/functions/rand - https://security.metacpan.org/docs/guides/random-data-for-security.html - https://metacpan.org/release/BAREFOOT/Data-Random-0.13/source/lib/Data/Random.pm#L537 - https://metacpan.org/release/LOCALSHOP/WebService-Xero-0.11/source/lib/WebService/Xero/Agent.pm#L17 - https://metacpan.org/release/LOCALSHOP/WebService-Xero-0.11/source/lib/WebService/Xero/Agent.pm#L178 - https://metacpan.org/release/LOCALSHOP/WebService-Xero-0.11/source/lib/WebService/Xero/Agent/PublicApplication.pm#L13 - https://metacpan.org/release/LOCALSHOP/WebService-Xero-0.11/source/lib/WebService/Xero/Agent/PublicApplication.pm#L93
CVE ID: CVE-2024-52323 State: PUBLISHED Published: 2024-11-27T09:54:07.999Z Last Updated: 2025-08-27T21:43:04.930Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: ManageEngine Products: Analytics Plus Problem Types: CWE-200 Description: Zohocorp ManageEngine Analytics Plus versions below 6100 are vulnerable to authenticated sensitive data exposure which allows the users to retrieve sensitive tokens associated to the org-admin account. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.manageengine.com/analytics-plus/CVE-2024-52323.html
CVE ID: CVE-2024-52324 State: PUBLISHED Published: 2024-12-06T18:25:06.031Z Last Updated: 2024-12-06T20:24:31.142Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Ruijie Products: Reyee OS Problem Types: CWE-242 Description: Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x uses an inherently dangerous function which could allow an attacker to send a malicious MQTT message resulting in devices executing arbitrary OS commands. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-338-01
CVE ID: CVE-2024-52325 State: PUBLISHED Published: 2025-01-23T15:56:30.185Z Last Updated: 2025-02-12T20:41:26.651Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: ECOVACS Products: GOAT G1, GOAT G1-800, DEEBOT X2S, DEEBOT X5 PRO, DEEBOT X5 PRO PLUS, DEEBOT T30 OMNI, DEEBOT T30S, GOAT G1-2000, GOAT GX-600, DEEBOT X2 OMNI, DEEBOT X2 COMBO, DEEBOT X5 PRO ULTRA Problem Types: CWE-77 Description: ECOVACS robot lawnmowers and vacuums are vulnerable to command injection via SetNetPin() over an unauthenticated BLE connection. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://dontvacuum.me/talks/DEFCON32/DEFCON32_reveng_hacking_ecovacs_robots
otes: - CISA ADP Vulnrichment: References: - https://dontvacuum.me/talks/DEFCON32/DEFCON32_reveng_hacking_ecovacs_robots.pdf - https://youtu.be/_wUsM0Mlenc?t=2041 - https://www.ecovacs.com/global/userhelp/dsa20241130001 - https://www.ecovacs.com/global/userhelp/dsa20241119
CVE ID: CVE-2024-52327 State: PUBLISHED Published: 2025-01-23T16:39:27.516Z Last Updated: 2025-02-12T20:41:28.703Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: ECOVACS Products: ECOVACS HOME, cloud service Problem Types: CWE-603, CWE-807 Description: The cloud service used by ECOVACS robot lawnmowers and vacuums allows authenticated attackers to bypass the PIN entry required to access the live video feed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://dontvacuum.me/talks/HITCON2024/HITCON-CMT-2024_Ecovacs.pdf - https://dontvacuum.me/talks/37c3-2023/37c3-vacuuming-and-mowing.pdf - https://www.ecovacs.com/global/userhelp/dsa2024121
https://dontvacuum.me/talks/37c3-2023/37c3-vacuuming-and-mowing.pdf - https://www.ecovacs.com/global/userhelp/dsa20241217002
CVE ID: CVE-2024-52328 State: PUBLISHED Published: 2025-01-23T16:35:23.197Z Last Updated: 2025-02-12T20:41:29.266Z Severity: LOW (CVSS 2.3 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N) Vendors: ECOVACS Products: Unspecified robots Problem Types: CWE-732 Description: ECOVACS robot lawnmowers and vacuums insecurely store audio files used to indicate that the camera is on. An attacker with access to the /data filesystem can delete or modify warning files such that users may not be aware that the camera is on. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://dontvacuum.me/talks/HITCON2024/HITCON-CMT-2024_Ecovacs.pdf - https://dontvacuum.me/talks/37c3-2023/37c3-vacuuming-a
ps://dontvacuum.me/talks/HITCON2024/HITCON-CMT-2024_Ecovacs.pdf - https://dontvacuum.me/talks/37c3-2023/37c3-vacuuming-and-mowing.pdf
CVE ID: CVE-2024-52329 State: PUBLISHED Published: 2025-01-23T16:36:06.533Z Last Updated: 2025-02-12T20:41:29.110Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: ECOVACS Products: ECOVACS HOME Problem Types: CWE-295 Description: ECOVACS HOME mobile app plugins for specific robots do not properly validate TLS certificates. An unauthenticated attacker can read or modify TLS traffic and obtain authentication tokens. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://dontvacuum.me/talks/HITCON2024/HITCON-CMT-2024_Ecovacs.pdf - https://dontvacuum.me/talks/37c3-2023/37c3-vacuuming-and-mowing.pdf - https://www.ecovacs.com/global/userhelp/dsa202
f - https://dontvacuum.me/talks/37c3-2023/37c3-vacuuming-and-mowing.pdf - https://www.ecovacs.com/global/userhelp/dsa20241217001
CVE ID: CVE-2024-52330 State: PUBLISHED Published: 2025-01-23T16:36:50.128Z Last Updated: 2025-02-12T20:41:28.969Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: ECOVACS Products: DEEBOT X5 PRO PLUS, DEEBOT X5 PRO, DEEBOT X2S, DEEBOT X2 OMNI, DEEBOT X1 TURBO, DEEBOT X1, DEEBOT X1S PRO, DEEBOT X1e OMNI, DEEBOT T10 PLUS, DEEBOT T10 OMNI, DEEBOT X5 PRO ULTRA, Mate X, DEEBOT X2 PRO, DEEBOT X2 COMBO, DEEBOT X1 OMNI, DEEBOT X1 PRO OMNI, DEEBOT X1 PLUS, DEEBOT X1S PRO PLUS, DEEBOT T10 TURBO, DEEBOT T10 Problem Types: CWE-295 Description: ECOVACS lawnmowers and vacuums do not properly validate TLS certificates. An unauthenticated attacker can read or modify TLS traff
wnmowers and vacuums do not properly validate TLS certificates. An unauthenticated attacker can read or modify TLS traffic, possibly modifying firmware updates. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://dontvacuum.me/talks/HITCON2024/HITCON-CMT-2024_Ecovacs.pdf - https://dontvacuum.me/talks/37c3-2023/37c3-vacuuming-and-mowing.pdf - https://www.ecovacs.com/global/userhelp/dsa20241217001
CVE ID: CVE-2024-52331 State: PUBLISHED Published: 2025-01-23T16:37:31.290Z Last Updated: 2025-10-02T14:10:10.821Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: ECOVACS Products: Unspecified robots Problem Types: CWE-494, CWE-1391, CWE-327 Description: ECOVACS robot lawnmowers and vacuums use a deterministic symmetric key to decrypt firmware updates. An attacker can create and encrypt malicious firmware that will be successfully decrypted and installed by the robot. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://dontvacuum.me/talks/HITCON2024/HITCON-CMT-2024_Ecovacs.html - https://dontvacuum.me/talks/37c3-2023/37c3-vacuuming-and-mow
ntvacuum.me/talks/HITCON2024/HITCON-CMT-2024_Ecovacs.html - https://dontvacuum.me/talks/37c3-2023/37c3-vacuuming-and-mowing.pdf
CVE ID: CVE-2024-52332 State: PUBLISHED Published: 2025-01-11T12:25:21.014Z Last Updated: 2025-11-03T20:45:31.870Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: igb: Fix potential invalid memory access in igb_init_module() The pci_register_driver() can fail and when this happened, the dca_notifier needs to be unregistered, otherwise the dca_notifier can be called when igb fails to install, resulting to invalid memory access. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/4458046617dfadc351162dbaea1945c57eebdf36 - https://git.kernel.org/stable/c/e0155b1b1509d0ef4799bd1cd73309ca4
rg/stable/c/4458046617dfadc351162dbaea1945c57eebdf36 - https://git.kernel.org/stable/c/e0155b1b1509d0ef4799bd1cd73309ca466df3f3 - https://git.kernel.org/stable/c/4fe517643f529e805bb6b890a4331c100e8f2484 - https://git.kernel.org/stable/c/8009cdcc493fa30d4572016daf2d6999da4d6c54 - https://git.kernel.org/stable/c/f309733a8c9da7d4266a8a3755020b738a570cae - https://git.kernel.org/stable/c/992fd34122de377b45cb75b64fc7f17fc1e6ed2f - https://git.kernel.org/stable/c/0566f83d206c7a864abcd741fe39d6e0ae5eef29
CVE ID: CVE-2024-52333 State: PUBLISHED Published: 2025-01-13T14:10:57.919Z Last Updated: 2025-11-03T20:45:33.498Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: OFFIS Products: DCMTK Problem Types: CWE-119 Description: An improper array index validation vulnerability exists in the determineMinMax functionality of OFFIS DCMTK 3.6.8. A specially crafted DICOM file can lead to an out-of-bounds write. An attacker can provide a malicious file to trigger this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2024-2121 - https://git.dcmtk.org/?p=dcmtk.gi
r: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2024-2121 - https://git.dcmtk.org/?p=dcmtk.git;a=commit;h=03e851b0586d05057c3268988e180ffb426b2e03
CVE ID: CVE-2024-52335 State: PUBLISHED Published: 2024-12-06T13:14:16.935Z Last Updated: 2024-12-06T17:58:49.178Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: syngo.plaza VB30E Problem Types: CWE-89 Description: A vulnerability has been identified in syngo.plaza VB30E (All versions < VB30E_HF05). The affected application do not properly sanitize input data before sending it to the SQL server. This could allow an attacker with access to the application could use this vulnerability to execute malicious SQL commands to compromise the whole database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://ww
L commands to compromise the whole database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.siemens-healthineers.com/en-us/support-documentation/cybersecurity/shsa-160244
CVE ID: CVE-2024-52336 State: PUBLISHED Published: 2024-11-26T15:21:13.518Z Last Updated: 2025-11-08T03:14:13.425Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Red Hat Products: Fast Datapath for Red Hat Enterprise Linux 8, Fast Datapath for Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9, Fast Datapath for RHEL 7, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8 Problem Types: CWE-269 Description: A script injection vulnerability was identified in the Tuned package. The `instance_create()` D-Bus function can be called by locally logged-in users without authentication. This flaw allows a
`instance_create()` D-Bus function can be called by locally logged-in users without authentication. This flaw allows a local non-privileged user to execute a D-Bus call with `script_pre` or `script_post` options that permit arbitrary scripts with their absolute paths to be passed. These user or attacker-controlled executable scripts or programs could then be executed by Tuned with root privileges that could allow attackers to local privilege escalation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2024:10384 - https://access.redhat.com/errata/RHSA-2025:0879 - https://access.redhat.com/errata/RHSA-2025:0880 -
a/RHSA-2024:10384 - https://access.redhat.com/errata/RHSA-2025:0879 - https://access.redhat.com/errata/RHSA-2025:0880 - https://access.redhat.com/security/cve/CVE-2024-52336 - https://bugzilla.redhat.com/show_bug.cgi?id=2324540 - https://security.opensuse.org/2024/11/26/tuned-instance-create.html - https://www.openwall.com/lists/oss-security/2024/11/28/1