Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-38863 State: PUBLISHED Published: 2024-10-14T07:19:07.625Z Last Updated: 2024-10-14T15:34:11.188Z Vendors: Checkmk GmbH Products: Checkmk Problem Types: CWE-598 Description: Exposure of CSRF tokens in query parameters on specific requests in Checkmk GmbH's Checkmk versions <2.3.0p18, <2.2.0p35 and <2.1.0p48 could lead to a leak of the token to facilitate targeted phishing attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://checkmk.com/werk/17096
CVE ID: CVE-2024-38864 State: PUBLISHED Published: 2024-12-19T16:07:13.213Z Last Updated: 2024-12-20T20:16:55.606Z Vendors: Checkmk GmbH Products: Checkmk Problem Types: CWE-732 Description: Incorrect permissions on the Checkmk Windows Agent's data directory in Checkmk < 2.3.0p23, < 2.2.0p38 and <= 2.1.0p49 (EOL) allows a local attacker to read sensitive data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://checkmk.com/werk/17098
CVE ID: CVE-2024-38865 State: PUBLISHED Published: 2025-04-10T07:35:35.143Z Last Updated: 2025-04-10T13:09:56.033Z Vendors: Checkmk GmbH Products: Checkmk Problem Types: CWE-140 Description: Improper neutralization of livestatus command delimiters in a specific endpoint within RestAPI of Checkmk prior to 2.2.0p39, 2.3.0p25, and 2.1.0p51 (EOL) allows arbitrary livestatus command execution. Exploitation requires the attacker to have a contact group assigned to their user account and for an event to originate from a host with the same contact group or from an event generated with an unknown host. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://checkmk.com/werk/17028
CVE ID: CVE-2024-38866 State: PUBLISHED Published: 2025-05-27T07:01:35.160Z Last Updated: 2025-11-03T19:30:20.670Z Vendors: Nagvis Products: Nagvis Problem Types: CWE-140 Description: Improper neutralization of input in Nagvis before version 1.9.47 which can lead to livestatus injection Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/NagVis/nagvis/pull/398/commits/8d5d07e22dfca78df7420ac81cffff6f45ca9694 - https://www.nagvis.org/downloads/changelog/1.9.47
CVE ID: CVE-2024-38867 State: PUBLISHED Published: 2024-07-09T12:05:10.052Z Last Updated: 2025-11-11T20:20:21.273Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Siemens Products: SIPROTEC 5 6MD84 (CP300), SIPROTEC 5 6MD85 (CP200), SIPROTEC 5 6MD85 (CP300), SIPROTEC 5 6MD86 (CP200), SIPROTEC 5 6MD86 (CP300), SIPROTEC 5 6MD89 (CP300), SIPROTEC 5 6MU85 (CP300), SIPROTEC 5 7KE85 (CP200), SIPROTEC 5 7KE85 (CP300), SIPROTEC 5 7SA82 (CP100), SIPROTEC 5 7SA82 (CP150), SIPROTEC 5 7SA84 (CP200), SIPROTEC 5 7SA86 (CP200), SIPROTEC 5 7SA86 (CP300), SIPROTEC 5 7SA87 (CP200), SIPROTEC 5 7SA87 (CP300), SIPROTEC 5 7SD82 (CP100), SIPROTEC 5 7SD82 (CP150), SIPROTEC 5 7SD84
IPROTEC 5 7SA87 (CP200), SIPROTEC 5 7SA87 (CP300), SIPROTEC 5 7SD82 (CP100), SIPROTEC 5 7SD82 (CP150), SIPROTEC 5 7SD84 (CP200), SIPROTEC 5 7SD86 (CP200), SIPROTEC 5 7SD86 (CP300), SIPROTEC 5 7SD87 (CP200), SIPROTEC 5 7SD87 (CP300), SIPROTEC 5 7SJ81 (CP100), SIPROTEC 5 7SJ81 (CP150), SIPROTEC 5 7SJ82 (CP100), SIPROTEC 5 7SJ82 (CP150), SIPROTEC 5 7SJ85 (CP200), SIPROTEC 5 7SJ85 (CP300), SIPROTEC 5 7SJ86 (CP200), SIPROTEC 5 7SJ86 (CP300), SIPROTEC 5 7SK82 (CP100), SIPROTEC 5 7SK82 (CP150), SIPROTEC 5 7SK85 (CP200), SIPROTEC 5 7SK85 (CP300), SIPROTEC 5 7SL82 (CP100), SIPROTEC 5 7SL82 (CP150), SIPROTEC 5 7SL86 (CP200), SIPROTEC 5 7SL86 (CP300), SIPROTEC 5 7SL87 (CP200), SIPROTEC 5 7SL87 (CP300),
5 7SL82 (CP150), SIPROTEC 5 7SL86 (CP200), SIPROTEC 5 7SL86 (CP300), SIPROTEC 5 7SL87 (CP200), SIPROTEC 5 7SL87 (CP300), SIPROTEC 5 7SS85 (CP200), SIPROTEC 5 7SS85 (CP300), SIPROTEC 5 7ST85 (CP200), SIPROTEC 5 7ST85 (CP300), SIPROTEC 5 7ST86 (CP300), SIPROTEC 5 7SX82 (CP150), SIPROTEC 5 7SX85 (CP300), SIPROTEC 5 7UM85 (CP300), SIPROTEC 5 7UT82 (CP100), SIPROTEC 5 7UT82 (CP150), SIPROTEC 5 7UT85 (CP200), SIPROTEC 5 7UT85 (CP300), SIPROTEC 5 7UT86 (CP200), SIPROTEC 5 7UT86 (CP300), SIPROTEC 5 7UT87 (CP200), SIPROTEC 5 7UT87 (CP300), SIPROTEC 5 7VE85 (CP300), SIPROTEC 5 7VK87 (CP200), SIPROTEC 5 7VK87 (CP300), SIPROTEC 5 7VU85 (CP300), SIPROTEC 5 Communication Module ETH-BA-2EL (Rev.1), SIPROTE
(CP200), SIPROTEC 5 7VK87 (CP300), SIPROTEC 5 7VU85 (CP300), SIPROTEC 5 Communication Module ETH-BA-2EL (Rev.1), SIPROTEC 5 Communication Module ETH-BB-2FO (Rev. 1), SIPROTEC 5 Communication Module ETH-BD-2FO, SIPROTEC 5 Compact 7SX800 (CP050) Problem Types: CWE-326 Description: A vulnerability has been identified in SIPROTEC 5 6MD84 (CP300) (All versions < V9.64), SIPROTEC 5 6MD85 (CP200) (All versions), SIPROTEC 5 6MD85 (CP300) (All versions < V9.64), SIPROTEC 5 6MD86 (CP200) (All versions), SIPROTEC 5 6MD86 (CP300) (All versions < V9.64), SIPROTEC 5 6MD89 (CP300) (All versions < V9.64), SIPROTEC 5 6MU85 (CP300) (All versions < V9.64), SIPROTEC 5 7KE85 (CP200) (All versions), SIPROTEC 5 7K
rsions < V9.64), SIPROTEC 5 6MU85 (CP300) (All versions < V9.64), SIPROTEC 5 7KE85 (CP200) (All versions), SIPROTEC 5 7KE85 (CP300) (All versions < V9.64), SIPROTEC 5 7SA82 (CP100) (All versions < V8.90), SIPROTEC 5 7SA82 (CP150) (All versions < V9.65), SIPROTEC 5 7SA84 (CP200) (All versions), SIPROTEC 5 7SA86 (CP200) (All versions), SIPROTEC 5 7SA86 (CP300) (All versions < V9.65), SIPROTEC 5 7SA87 (CP200) (All versions), SIPROTEC 5 7SA87 (CP300) (All versions < V9.65), SIPROTEC 5 7SD82 (CP100) (All versions < V8.90), SIPROTEC 5 7SD82 (CP150) (All versions < V9.65), SIPROTEC 5 7SD84 (CP200) (All versions), SIPROTEC 5 7SD86 (CP200) (All versions), SIPROTEC 5 7SD86 (CP300) (All versions < V9.6
C 5 7SD84 (CP200) (All versions), SIPROTEC 5 7SD86 (CP200) (All versions), SIPROTEC 5 7SD86 (CP300) (All versions < V9.65), SIPROTEC 5 7SD87 (CP200) (All versions), SIPROTEC 5 7SD87 (CP300) (All versions < V9.65), SIPROTEC 5 7SJ81 (CP100) (All versions < V8.89), SIPROTEC 5 7SJ81 (CP150) (All versions < V9.65), SIPROTEC 5 7SJ82 (CP100) (All versions < V8.89), SIPROTEC 5 7SJ82 (CP150) (All versions < V9.65), SIPROTEC 5 7SJ85 (CP200) (All versions), SIPROTEC 5 7SJ85 (CP300) (All versions < V9.65), SIPROTEC 5 7SJ86 (CP200) (All versions), SIPROTEC 5 7SJ86 (CP300) (All versions < V9.65), SIPROTEC 5 7SK82 (CP100) (All versions < V8.89), SIPROTEC 5 7SK82 (CP150) (All versions < V9.65), SIPROTEC 5 7
< V9.65), SIPROTEC 5 7SK82 (CP100) (All versions < V8.89), SIPROTEC 5 7SK82 (CP150) (All versions < V9.65), SIPROTEC 5 7SK85 (CP200) (All versions), SIPROTEC 5 7SK85 (CP300) (All versions < V9.65), SIPROTEC 5 7SL82 (CP100) (All versions < V8.90), SIPROTEC 5 7SL82 (CP150) (All versions < V9.65), SIPROTEC 5 7SL86 (CP200) (All versions), SIPROTEC 5 7SL86 (CP300) (All versions < V9.65), SIPROTEC 5 7SL87 (CP200) (All versions), SIPROTEC 5 7SL87 (CP300) (All versions < V9.65), SIPROTEC 5 7SS85 (CP200) (All versions), SIPROTEC 5 7SS85 (CP300) (All versions < V9.64), SIPROTEC 5 7ST85 (CP200) (All versions), SIPROTEC 5 7ST85 (CP300) (All versions < V9.64), SIPROTEC 5 7ST86 (CP300) (All versions < V9.
85 (CP200) (All versions), SIPROTEC 5 7ST85 (CP300) (All versions < V9.64), SIPROTEC 5 7ST86 (CP300) (All versions < V9.64), SIPROTEC 5 7SX82 (CP150) (All versions < V9.65), SIPROTEC 5 7SX85 (CP300) (All versions < V9.65), SIPROTEC 5 7UM85 (CP300) (All versions < V9.64), SIPROTEC 5 7UT82 (CP100) (All versions < V8.90), SIPROTEC 5 7UT82 (CP150) (All versions < V9.65), SIPROTEC 5 7UT85 (CP200) (All versions), SIPROTEC 5 7UT85 (CP300) (All versions < V9.65), SIPROTEC 5 7UT86 (CP200) (All versions), SIPROTEC 5 7UT86 (CP300) (All versions < V9.65), SIPROTEC 5 7UT87 (CP200) (All versions), SIPROTEC 5 7UT87 (CP300) (All versions < V9.65), SIPROTEC 5 7VE85 (CP300) (All versions < V9.64), SIPROTEC 5
versions), SIPROTEC 5 7UT87 (CP300) (All versions < V9.65), SIPROTEC 5 7VE85 (CP300) (All versions < V9.64), SIPROTEC 5 7VK87 (CP200) (All versions), SIPROTEC 5 7VK87 (CP300) (All versions < V9.65), SIPROTEC 5 7VU85 (CP300) (All versions < V9.64), SIPROTEC 5 Communication Module ETH-BA-2EL (Rev.1) (All versions < V9.62 installed on CP150 and CP300 devices), SIPROTEC 5 Communication Module ETH-BA-2EL (Rev.1) (All versions installed on CP200 devices), SIPROTEC 5 Communication Module ETH-BA-2EL (Rev.1) (All versions < V8.89 installed on CP100 devices), SIPROTEC 5 Communication Module ETH-BB-2FO (Rev. 1) (All versions installed on CP200 devices), SIPROTEC 5 Communication Module ETH-BB-2FO (Rev.
Module ETH-BB-2FO (Rev. 1) (All versions installed on CP200 devices), SIPROTEC 5 Communication Module ETH-BB-2FO (Rev. 1) (All versions < V9.62 installed on CP150 and CP300 devices), SIPROTEC 5 Communication Module ETH-BB-2FO (Rev. 1) (All versions < V8.89 installed on CP100 devices), SIPROTEC 5 Communication Module ETH-BD-2FO (All versions < V9.62), SIPROTEC 5 Compact 7SX800 (CP050) (All versions < V9.64). The affected devices are supporting weak ciphers on several ports (443/tcp for web, 4443/tcp for DIGSI 5 and configurable port for syslog over TLS). This could allow an unauthorized attacker in a man-in-the-middle position to decrypt any data passed over to and from those ports. Addition
unauthorized attacker in a man-in-the-middle position to decrypt any data passed over to and from those ports. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/html/ssa-750499.html
CVE ID: CVE-2024-38868 State: PUBLISHED Published: 2024-08-30T17:44:38.932Z Last Updated: 2024-08-30T17:59:41.602Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L) Vendors: ManageEngine Products: Endpoint Central Problem Types: CWE-863 Description: Zohocorp ManageEngine Endpoint Central affected by Incorrect authorization vulnerability while isolating the devices.This issue affects Endpoint Central: before 11.3.2406.08 and before 11.3.2400.15 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.manageengine.com/products/desktop-central/security-updates-ngav.html
CVE ID: CVE-2024-38869 State: PUBLISHED Published: 2024-08-23T14:07:46.792Z Last Updated: 2024-08-30T18:47:26.580Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L) Vendors: ManageEngine Products: Endpoint Central Problem Types: CWE-863 Description: Zohocorp ManageEngine Endpoint Central affected by Incorrect authorization vulnerability in remote office deploy configurations.This issue affects Endpoint Central: before 11.3.2416.04 and before 11.3.2400.25. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.manageengine.com/products/desktop-central/security-updates-config-access.html
CVE ID: CVE-2024-38870 State: PUBLISHED Published: 2024-07-17T16:48:58.815Z Last Updated: 2024-08-02T04:19:20.403Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N) Vendors: ManageEngine Products: OpManager, OpManager Plus, OpManager MSP, OpManager Enterprise Edition Problem Types: CWE-79 Description: Zohocorp ManageEngine OpManager, OpManager Plus, OpManager MSP and OpManager Enterprise Edition versions before 128104, from 128151 before 128238, from 128247 before 128250 are vulnerable to Stored XSS vulnerability in reports module. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.manageengine.com/network-monitoring/secu
es: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.manageengine.com/network-monitoring/security-updates/cve-2024-38870.html
CVE ID: CVE-2024-38871 State: PUBLISHED Published: 2024-07-26T17:29:42.911Z Last Updated: 2024-08-02T04:19:20.491Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L) Vendors: ManageEngine Products: Exchange Reporter Plus Problem Types: CWE-89 Description: Zohocorp ManageEngine Exchange Reporter Plus versions 5717 and below are vulnerable to the authenticated SQL injection in the reports module. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.manageengine.com/products/exchange-reports/advisory/CVE-2024-38871.html
CVE ID: CVE-2024-38872 State: PUBLISHED Published: 2024-07-26T17:30:23.932Z Last Updated: 2024-08-02T04:19:20.244Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L) Vendors: ManageEngine Products: Exchange Reporter Plus Problem Types: CWE-89 Description: Zohocorp ManageEngine Exchange Reporter Plus versions 5717 and below are vulnerable to the authenticated SQL injection in the monitoring module. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.manageengine.com/products/exchange-reports/advisory/CVE-2024-38872.html
CVE ID: CVE-2024-38873 State: PUBLISHED Published: 2024-06-21T00:00:00.000Z Last Updated: 2025-03-14T18:26:35.526Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AC:L/AV:N/A:L/C:N/I:N/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the friendlycaptcha_official (aka Integration of Friendly Captcha) extension before 0.1.4 for TYPO3. The extension fails to check the requirement of the captcha field in submitted form data, allowing a remote user to bypass the captcha check. This only affects the captcha integration for the ext:form extension. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://typo3.org/secur
nsion. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://typo3.org/security/advisory/typo3-ext-sa-2024-004
CVE ID: CVE-2024-38874 State: PUBLISHED Published: 2024-06-21T00:00:00.000Z Last Updated: 2025-03-24T21:08:46.110Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AC:L/AV:N/A:N/C:L/I:L/PR:L/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the events2 (aka Events 2) extension before 8.3.8 and 9.x before 9.0.6 for TYPO3. Missing access checks in the management plugin lead to an insecure direct object reference (IDOR) vulnerability with the potential to activate or delete various events for unauthenticated users. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://typo3.org/security/advisory/typo3-ext-sa-2024-003
CVE ID: CVE-2024-38875 State: PUBLISHED Published: 2024-07-10T00:00:00.000Z Last Updated: 2025-11-04T16:12:24.941Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Django 4.2 before 4.2.14 and 5.0 before 5.0.7. urlize and urlizetrunc were subject to a potential denial of service attack via certain inputs with a very large number of brackets. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://docs.djangoproject.com/en/dev/releases/security/ - https://groups.google.com/forum/#%21forum/django-announce - https://www.djangoproject.com/weblog/2024/jul/09/security-releases/
CVE ID: CVE-2024-38876 State: PUBLISHED Published: 2024-08-02T10:36:16.928Z Last Updated: 2025-11-03T21:55:53.445Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:T/RC:C) Vendors: Siemens Products: Omnivise T3000 Application Server R9.2, Omnivise T3000 Domain Controller R9.2, Omnivise T3000 Product Data Management (PDM) R9.2, Omnivise T3000 R8.2 SP3, Omnivise T3000 R8.2 SP4, Omnivise T3000 Terminal Server R9.2, Omnivise T3000 Thin Client R9.2, Omnivise T3000 Whitelisting Server R9.2 Problem Types: CWE-552 Description: A vulnerability has been identified in Omnivise T3000 Application Server R9.2 (All versions), Omnivise T3000 Domain Controller R9.2 (All versions),
entified in Omnivise T3000 Application Server R9.2 (All versions), Omnivise T3000 Domain Controller R9.2 (All versions), Omnivise T3000 Product Data Management (PDM) R9.2 (All versions), Omnivise T3000 R8.2 SP3 (All versions), Omnivise T3000 R8.2 SP4 (All versions), Omnivise T3000 Terminal Server R9.2 (All versions), Omnivise T3000 Thin Client R9.2 (All versions), Omnivise T3000 Whitelisting Server R9.2 (All versions). The affected application regularly executes user modifiable code as a privileged user. This could allow a local authenticated attacker to execute arbitrary code with elevated privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: -
ode with elevated privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/html/ssa-857368.html
CVE ID: CVE-2024-38877 State: PUBLISHED Published: 2024-08-02T10:36:18.219Z Last Updated: 2025-11-03T21:55:54.936Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: Omnivise T3000 Application Server R9.2, Omnivise T3000 Domain Controller R9.2, Omnivise T3000 Network Intrusion Detection System (NIDS) R9.2, Omnivise T3000 Product Data Management (PDM) R9.2, Omnivise T3000 R8.2 SP3, Omnivise T3000 R8.2 SP4, Omnivise T3000 Security Server R9.2, Omnivise T3000 Terminal Server R9.2, Omnivise T3000 Thin Client R9.2, Omnivise T3000 Whitelisting Server R9.2 Problem Types: CWE-312 Description: A vulnerability has been identified in Omnivise
ivise T3000 Whitelisting Server R9.2 Problem Types: CWE-312 Description: A vulnerability has been identified in Omnivise T3000 Application Server R9.2 (All versions), Omnivise T3000 Domain Controller R9.2 (All versions), Omnivise T3000 Network Intrusion Detection System (NIDS) R9.2 (All versions), Omnivise T3000 Product Data Management (PDM) R9.2 (All versions), Omnivise T3000 R8.2 SP3 (All versions), Omnivise T3000 R8.2 SP4 (All versions), Omnivise T3000 Security Server R9.2 (All versions), Omnivise T3000 Terminal Server R9.2 (All versions), Omnivise T3000 Thin Client R9.2 (All versions), Omnivise T3000 Whitelisting Server R9.2 (All versions). The affected devices stores initial system cred
(All versions), Omnivise T3000 Whitelisting Server R9.2 (All versions). The affected devices stores initial system credentials without sufficient protection. An attacker with remote shell access or physical access could retrieve the credentials leading to confidentiality loss allowing the attacker to laterally move within the affected network. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/html/ssa-857368.html
CVE ID: CVE-2024-38878 State: PUBLISHED Published: 2024-08-02T10:36:19.439Z Last Updated: 2025-11-03T21:55:56.424Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: Omnivise T3000 Application Server R9.2, Omnivise T3000 R8.2 SP3, Omnivise T3000 R8.2 SP4 Problem Types: CWE-22 Description: A vulnerability has been identified in Omnivise T3000 Application Server R9.2 (All versions), Omnivise T3000 R8.2 SP3 (All versions), Omnivise T3000 R8.2 SP4 (All versions). Affected devices allow authenticated users to export diagnostics data. The corresponding API endpoint is susceptible to path traversal and could allow an authenticated attacke
agnostics data. The corresponding API endpoint is susceptible to path traversal and could allow an authenticated attacker to download arbitrary files from the file system. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/html/ssa-857368.html
CVE ID: CVE-2024-38879 State: PUBLISHED Published: 2024-08-02T10:36:20.639Z Last Updated: 2025-11-03T21:55:57.892Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C) Vendors: Siemens Products: Omnivise T3000 Application Server R9.2, Omnivise T3000 R8.2 SP3, Omnivise T3000 R8.2 SP4 Problem Types: CWE-20 Description: A vulnerability has been identified in Omnivise T3000 Application Server R9.2 (All versions), Omnivise T3000 R8.2 SP3 (All versions), Omnivise T3000 R8.2 SP4 (All versions). The affected system exposes the port of an internal application on the public network interface allowing an attacker to circumvent authentication and directly access the expos
lication on the public network interface allowing an attacker to circumvent authentication and directly access the exposed application. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/html/ssa-857368.html
CVE ID: CVE-2024-38881 State: PUBLISHED Published: 2024-08-02T00:00:00 Last Updated: 2024-08-07T15:28:03.438850 Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Horizon Business Services Inc. Caterease 16.0.1.1663 through 24.0.1.2405 and possibly later versions, allows a remote attacker to perform a Rainbow Table Password cracking attack due to the use of one-way hashes without salts when storing user passwords. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://caterease.com - http://horizon.com - https://vuldb.com/?id.273365 - https://packetstormsecurity.com/files/179892/Caterease-Software-SQL-Injection-Command-Injection-Bypass.html
CVE ID: CVE-2024-38882 State: PUBLISHED Published: 2024-08-02T00:00:00 Last Updated: 2024-08-07T15:28:21.567300 Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Horizon Business Services Inc. Caterease 16.0.1.1663 through 24.0.1.2405 and possibly later versions, allows a remote attacker to perform command line execution through SQL Injection due to improper neutralization of special elements used in an OS command. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://caterease.com - http://horizon.com - https://vuldb.com/?id.273366 - https://packetstormsecurity.com/files/179892/Caterease-Software-SQL-Injection-Command-Injection-Bypass.html
CVE ID: CVE-2024-38883 State: PUBLISHED Published: 2024-08-02T00:00:00 Last Updated: 2024-08-07T15:29:18.126968 Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Horizon Business Services Inc. Caterease 16.0.1.1663 through 24.0.1.2405 and possibly later versions, allows a remote attacker to perform a Drop Encryption Level attack due to the selection of a less-secure algorithm during negotiation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://caterease.com - http://horizon.com - https://vuldb.com/?id.273367 - https://packetstormsecurity.com/files/179892/Caterease-Software-SQL-Injection-Command-Injection-Bypass.html
CVE ID: CVE-2024-38884 State: PUBLISHED Published: 2024-08-02T00:00:00 Last Updated: 2024-08-07T15:29:55.919538 Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Horizon Business Services Inc. Caterease 16.0.1.1663 through 24.0.1.2405 and possibly later versions, allows a local attacker to perform an Authentication Bypass attack due to improperly implemented security checks for standard authentication mechanisms Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://caterease.com - http://horizon.com - https://vuldb.com/?id.273368 - https://packetstormsecurity.com/files/179892/Caterease-Software-SQL-Injection-Command-Injection-Bypass.html
CVE ID: CVE-2024-38885 State: PUBLISHED Published: 2024-08-02T00:00:00 Last Updated: 2024-08-03T18:25:07.861Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Horizon Business Services Inc. Caterease 16.0.1.1663 through 24.0.1.2405 and possibly later versions, allows a remote attacker to perform unauthorized access using known operating system credentials due to hardcoded SQL user credentials in the client application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://caterease.com - http://horizon.com - https://vuldb.com/?id.273369
CVE ID: CVE-2024-38886 State: PUBLISHED Published: 2024-08-02T00:00:00 Last Updated: 2024-08-12T19:57:21.532Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Horizon Business Services Inc. Caterease 16.0.1.1663 through 24.0.1.2405 and possibly later versions, allows a remote attacker to perform a Traffic Injection attack due to improper verification of the source of a communication channel. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://caterease.com - http://horizon.com - https://vuldb.com/?id.273370 - https://packetstormsecurity.com/files/179892/Caterease-Software-SQL-Injection-Command-Injection-Bypass.html