Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-8862 State: PUBLISHED Published: 2024-09-14T19:31:04.957Z Last Updated: 2024-09-16T14:16:28.093Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: h2oai Products: h2o-3 Problem Types: CWE-502 Description: A vulnerability, which was classified as critical, has been found in h2oai h2o-3 3.46.0.4. This issue affects the function getConnectionSafe of the file /dtale/chart-data/1 of the component JDBC Connection Handler. The manipulation of the argument query leads to deserialization. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Ad
d to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.277499 - https://vuldb.com/?ctiid.277499 - https://vuldb.com/?submit.403200 - https://rumbling-slice-eb0.notion.site/Unauthenticated-Remote-Command-Execution-via-Panda-df-query-9dc40f0477ee4b65806de7921876c222?pvs=4
CVE ID: CVE-2024-8863 State: PUBLISHED Published: 2024-09-14T23:00:05.339Z Last Updated: 2024-09-16T14:13:21.333Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: aimhubio Products: aim Problem Types: CWE-79 Description: A vulnerability, which was classified as problematic, was found in aimhubio aim up to 3.24. Affected is the function dangerouslySetInnerHTML of the file textbox.tsx of the component Text Explorer. The manipulation of the argument query leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additiona
e public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.277500 - https://vuldb.com/?ctiid.277500 - https://vuldb.com/?submit.403203 - https://rumbling-slice-eb0.notion.site/Stored-XSS-through-TEXT-EXPLORER-in-aimhubio-aim-d0f07b7194724950a673498546d80d43?pvs=4
CVE ID: CVE-2024-8864 State: PUBLISHED Published: 2024-09-15T00:31:04.359Z Last Updated: 2024-09-16T20:20:11.603Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: composiohq Products: composio Problem Types: CWE-94 Description: A vulnerability has been found in composiohq composio up to 0.5.6 and classified as critical. Affected by this vulnerability is the function Calculator of the file python/composio/tools/local/mathematical/actions/calculator.py. The manipulation leads to code injection. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Not
may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.277501 - https://vuldb.com/?ctiid.277501 - https://vuldb.com/?submit.403204 - https://rumbling-slice-eb0.notion.site/Composio-s-Local-tools-Mathematical-has-a-code-injection-risk-in-composiohq-composio-ea0e89ee10fe4edfb9a8cfeed158c765?pvs=4
CVE ID: CVE-2024-8865 State: PUBLISHED Published: 2024-09-15T01:00:06.013Z Last Updated: 2024-09-16T20:19:08.269Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: composiohq Products: composio Problem Types: CWE-22 Description: A vulnerability was found in composiohq composio up to 0.5.8 and classified as problematic. Affected by this issue is the function path of the file composio\server\api.py. The manipulation of the argument file leads to path traversal. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: Reference
early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.277502 - https://vuldb.com/?ctiid.277502 - https://vuldb.com/?submit.403206 - https://rumbling-slice-eb0.notion.site/There-is-an-arbitrary-file-read-vulnerability-at-api-download-in-composiohq-composio-f0ec1ec26a5f434a97bb1ffde435a35b?pvs=4
CVE ID: CVE-2024-8866 State: PUBLISHED Published: 2024-09-15T01:31:05.487Z Last Updated: 2024-09-16T20:16:50.376Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: n/a Products: AutoCMS Problem Types: CWE-79 Description: A vulnerability was found in AutoCMS 5.4. It has been classified as problematic. This affects an unknown part of the file /admin/robot.php. The manipulation of the argument sidebar leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.277503 - https://vuldb.com/?ctiid.277503 - https://vuldb.com/
CISA ADP Vulnrichment: References: - https://vuldb.com/?id.277503 - https://vuldb.com/?ctiid.277503 - https://vuldb.com/?submit.407460 - https://github.com/Hebing123/cve/issues/68
CVE ID: CVE-2024-8867 State: PUBLISHED Published: 2024-09-15T02:31:05.156Z Last Updated: 2024-09-16T20:09:42.132Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: Perfex Products: CRM Problem Types: CWE-79 Description: A vulnerability was found in Perfex CRM 3.1.6. It has been declared as problematic. This vulnerability affects unknown code of the file application/controllers/Clients.php of the component Parameter Handler. The manipulation of the argument message leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. Additional Analyst Notes: - CISA ADP
the public and may be used. It is recommended to apply a patch to fix this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.277504 - https://vuldb.com/?ctiid.277504 - https://vuldb.com/?submit.408014 - https://bytium.com/stored-cross-site-scripting-xss-vulnerability-in-perfex-crm/
CVE ID: CVE-2024-8868 State: PUBLISHED Published: 2024-09-15T03:00:06.905Z Last Updated: 2024-09-16T20:07:34.237Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: code-projects Products: Crud Operation System Problem Types: CWE-89 Description: A vulnerability was found in code-projects Crud Operation System 1.0. It has been rated as critical. This issue affects some unknown processing of the file savedata.php. The manipulation of the argument sname leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.277505 - https://vuldb.c
be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.277505 - https://vuldb.com/?ctiid.277505 - https://vuldb.com/?submit.408322 - https://github.com/ppp-src/a/issues/7 - https://code-projects.org/
CVE ID: CVE-2024-8869 State: PUBLISHED Published: 2024-09-15T10:31:05.443Z Last Updated: 2024-09-16T20:05:10.010Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: TOTOLINK Products: A720R Problem Types: CWE-78 Description: A vulnerability classified as critical has been found in TOTOLINK A720R 4.1.5. Affected is the function exportOvpn. The manipulation leads to os command injection. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References:
ly about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.277506 - https://vuldb.com/?ctiid.277506 - https://vuldb.com/?submit.403211 - https://www.totolink.net/
CVE ID: CVE-2024-8870 State: PUBLISHED Published: 2024-10-26T03:13:51.846Z Last Updated: 2024-10-28T17:41:37.300Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: fatcatapps Products: Forms for Mailchimp by Optin Cat – Grow Your MailChimp List Problem Types: CWE-79 Description: The Forms for Mailchimp by Optin Cat – Grow Your MailChimp List plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.5.6. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick
ible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/86389489-9f9d-479b-b351-19f25166fc91?source=cve - https://plugins.trac.wordpress.org/browser/mailchimp-wp/trunk/includes/eoi-subscribers.php#L353
CVE ID: CVE-2024-8871 State: PUBLISHED Published: 2024-10-30T05:32:15.313Z Last Updated: 2024-10-30T13:01:52.521Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: fatcatapps Products: Pricing Tables WordPress Plugin – Easy Pricing Tables Problem Types: CWE-79 Description: The Pricing Tables WordPress Plugin – Easy Pricing Tables plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 3.2.5. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into
uthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a5e4f40b-c028-4283-ba02-c77408136713?source=cve - https://plugins.trac.wordpress.org/browser/easy-pricing-tables/trunk/includes/ept-block.php#L304 - https://plugins.trac.wordpress.org/browser/easy-pricing-tables/trunk/includes/notices/notices.php#L91
CVE ID: CVE-2024-8872 State: PUBLISHED Published: 2024-09-26T08:29:45.765Z Last Updated: 2024-09-26T13:31:53.746Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: bizswoop Products: Store Hours for WooCommerce Problem Types: CWE-80 Description: The Store Hours for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 4.3.20. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Addi
s in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6cbb51fe-ae7f-4fe8-89ad-38f6d3238cea?source=cve - https://plugins.trac.wordpress.org/changeset/3157721/ - https://plugins.trac.wordpress.org/browser/order-hours-scheduler-for-woocommerce/tags/4.3.20/includes/Aspect/Page.php#L155
CVE ID: CVE-2024-8873 State: PUBLISHED Published: 2024-11-16T03:20:52.200Z Last Updated: 2024-11-16T15:11:45.198Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: peprodev Products: PeproDev WooCommerce Receipt Uploader Problem Types: CWE-79 Description: The PeproDev WooCommerce Receipt Uploader plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.6.9. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as click
rbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e09c2916-6e2c-4db3-901a-b5715d635824?source=cve - https://plugins.trac.wordpress.org/browser/pepro-bacs-receipt-upload-for-woocommerce/trunk/wc-upload-reciept.php#L163
CVE ID: CVE-2024-8874 State: PUBLISHED Published: 2024-11-13T02:02:35.951Z Last Updated: 2024-11-13T14:41:33.626Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: kaminskym Products: AJAX Login and Registration modal popup + inline form Problem Types: CWE-79 Description: The AJAX Login and Registration modal popup + inline form plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.24. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into pe
henticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c11a561a-c798-46e7-bf2d-12933978aa29?source=cve - https://plugins.trac.wordpress.org/browser/ajax-login-and-registration-modal-popup/trunk/includes/class-settings.php#L177
CVE ID: CVE-2024-8875 State: PUBLISHED Published: 2024-09-15T21:31:03.787Z Last Updated: 2024-09-16T18:10:33.173Z Severity: N/A (CVSS 5.5 AV:N/AC:L/Au:S/C:N/I:P/A:P) Vendors: vedees Products: wcms Problem Types: CWE-22 Description: A vulnerability classified as critical was found in vedees wcms up to 0.3.2. Affected by this vulnerability is an unknown functionality of the file /wex/finder.php. The manipulation of the argument p leads to path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: Referenc
early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.277507 - https://vuldb.com/?ctiid.277507 - https://vuldb.com/?submit.404206 - https://github.com/acmglz/bug2_report/blob/main/wcms%20has%20arbitrary%20file%20deletion.md
CVE ID: CVE-2024-8876 State: PUBLISHED Published: 2024-09-15T22:00:09.055Z Last Updated: 2024-09-16T14:56:38.150Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: xiaohe4966 Products: TpMeCMS Problem Types: CWE-22 Description: A vulnerability, which was classified as problematic, has been found in xiaohe4966 TpMeCMS up to 1.3.3.1. Affected by this issue is some unknown functionality of the file /index/ajax/lang. The manipulation of the argument lang leads to path traversal. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.3.3.2 is able to address this issue. It is recommended to upgrade
to the public and may be used. Upgrading to version 1.3.3.2 is able to address this issue. It is recommended to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.277508 - https://vuldb.com/?ctiid.277508 - https://vuldb.com/?submit.404560 - https://wiki.shikangsi.com/post/share/12da81ed-2dad-4a75-9b1a-db9afe1e7b7b
CVE ID: CVE-2024-8877 State: PUBLISHED Published: 2024-09-24T15:19:31.932Z Last Updated: 2025-11-04T16:16:07.925Z Vendors: Riello Products: Netman 204 Problem Types: CWE-89 Description: Improper neutralization of special elements results in a SQL Injection vulnerability in Riello Netman 204. It is only limited to the SQLite database of measurement data.This issue affects Netman 204: through 4.05. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cyberdanube.com/en/en-multiple-vulnerabilities-in-riello-netman-204/index.html
CVE ID: CVE-2024-8878 State: PUBLISHED Published: 2024-09-24T15:14:31.153Z Last Updated: 2025-11-04T16:16:08.912Z Vendors: Riello Products: Netman 204 Problem Types: CWE-640 Description: The password recovery mechanism for the forgotten password in Riello Netman 204 allows an attacker to reset the admin password and take over control of the device.This issue affects Netman 204: through 4.05. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cyberdanube.com/en/en-multiple-vulnerabilities-in-riello-netman-204/index.html
CVE ID: CVE-2024-8880 State: PUBLISHED Published: 2024-09-16T00:31:04.027Z Last Updated: 2024-09-16T14:56:50.578Z Severity: MEDIUM (CVSS 5.6 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: n/a Products: playSMS Problem Types: CWE-94 Description: A vulnerability classified as critical has been found in playSMS 1.4.4/1.4.5/1.4.6/1.4.7. Affected is an unknown function of the file /playsms/index.php?app=main&inc=core_auth&route=forgot&op=forgot of the component Template Handler. The manipulation of the argument username/email/captcha leads to code injection. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult
le to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component. The project maintainer was informed early about the issue. Investigation shows that playSMS up to 1.4.3 contained a fix but later versions re-introduced the flaw. As long as the latest version of the playsms/tpl package is used, the software is not affected. Version >=1.4.4 shall fix this issue for sure. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.277524 - https://vuldb.com/?ctiid.277524 - https://vuldb.com/?submit.4
Vulnrichment: References: - https://vuldb.com/?id.277524 - https://vuldb.com/?ctiid.277524 - https://vuldb.com/?submit.406095
CVE ID: CVE-2024-8881 State: PUBLISHED Published: 2024-11-12T01:17:36.728Z Last Updated: 2024-11-12T16:16:27.550Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Zyxel Products: GS1900-48 firmware Problem Types: CWE-78 Description: A post-authentication command injection vulnerability in the CGI program in the Zyxel GS1900-48 switch firmware version V2.80(AAHN.1)C0 and earlier could allow an authenticated, LAN-based attacker with administrator privileges to execute some operating system (OS) commands on an affected device by sending a crafted HTTP request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zyxel.com/global/en/suppor
ed HTTP request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-post-authentication-command-injection-and-buffer-overflow-vulnerabilities-in-gs1900-series-switches-11-12-2024
CVE ID: CVE-2024-8882 State: PUBLISHED Published: 2024-11-12T01:23:57.405Z Last Updated: 2024-11-12T14:27:10.174Z Severity: MEDIUM (CVSS 4.5 CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: Zyxel Products: GS1900-48 firmware Problem Types: CWE-120 Description: A buffer overflow vulnerability in the CGI program in the Zyxel GS1900-48 switch firmware version V2.80(AAHN.1)C0 and earlier could allow an authenticated, LAN-based attacker with administrator privileges to cause denial of service (DoS) conditions via a crafted URL. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-post-authent
ment: References: - https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-post-authentication-command-injection-and-buffer-overflow-vulnerabilities-in-gs1900-series-switches-11-12-2024
CVE ID: CVE-2024-8883 State: PUBLISHED Published: 2024-09-19T15:48:28.468Z Last Updated: 2025-11-11T15:58:49.019Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Red Hat Products: Red Hat Build of Keycloak, Red Hat build of Keycloak 22, Red Hat build of Keycloak 24, Red Hat JBoss Enterprise Application Platform 8, Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8, Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9, Red Hat Single Sign-On 7, Red Hat Single Sign-On 7.6 for RHEL 7, Red Hat Single Sign-On 7.6 for RHEL 8, Red Hat Single Sign-On 7.6 for RHEL 9, RHEL-8 based Middleware Containers Problem Types: CWE-601 Description: A misconfigu
d Hat Single Sign-On 7.6 for RHEL 9, RHEL-8 based Middleware Containers Problem Types: CWE-601 Description: A misconfiguration flaw was found in Keycloak. This issue can allow an attacker to redirect users to an arbitrary URL if a 'Valid Redirect URI' is set to http://localhost or http://127.0.0.1, enabling sensitive information such as authorization codes to be exposed to the attacker, potentially leading to session hijacking. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2024:10385 - https://access.redhat.com/errata/RHSA-2024:10386 - https://access.redhat.com/errata/RHSA-2024:6878 - https://access.redhat.com/errata/RHSA-2024:6879 - h
/RHSA-2024:10386 - https://access.redhat.com/errata/RHSA-2024:6878 - https://access.redhat.com/errata/RHSA-2024:6879 - https://access.redhat.com/errata/RHSA-2024:6880 - https://access.redhat.com/errata/RHSA-2024:6882 - https://access.redhat.com/errata/RHSA-2024:6886 - https://access.redhat.com/errata/RHSA-2024:6887 - https://access.redhat.com/errata/RHSA-2024:6888 - https://access.redhat.com/errata/RHSA-2024:6889 - https://access.redhat.com/errata/RHSA-2024:6890 - https://access.redhat.com/errata/RHSA-2024:8823 - https://access.redhat.com/errata/RHSA-2024:8824 - https://access.redhat.com/errata/RHSA-2024:8826 - https://access.redhat.com/security/cve/CVE-2024-8883 - https://bugzilla.redhat.co
ess.redhat.com/errata/RHSA-2024:8826 - https://access.redhat.com/security/cve/CVE-2024-8883 - https://bugzilla.redhat.com/show_bug.cgi?id=2312511 - https://github.com/keycloak/keycloak/blob/main/services/src/main/java/org/keycloak/protocol/oidc/utils/RedirectUtils.java
CVE ID: CVE-2024-8884 State: PUBLISHED Published: 2024-10-08T10:32:24.555Z Last Updated: 2024-10-08T13:39:54.978Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Schneider Electric Products: System Monitor application in Harmony Industrial PC HMIBMO/HMIBMI/HMIPSO/HMIBMP/HMIBMU/HMIPSP/HMIPEP series, System Monitor application in Pro-face Industrial PC PS5000 series Problem Types: CWE-200 Description: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists that could cause exposure of credentials when attacker has access to application on network over http Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https
er has access to application on network over http Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-282-07&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-282-07.pdf