Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-40847 State: PUBLISHED Published: 2024-09-16T23:22:16.278Z Last Updated: 2025-11-04T16:13:14.694Z Vendors: Apple Products: macOS Problem Types: An app may be able to access sensitive user data Description: The issue was addressed with additional code-signing restrictions. This issue is fixed in macOS Ventura 13.7, macOS Sonoma 14.7, macOS Sequoia 15. An app may be able to access sensitive user data. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.apple.com/en-us/121234 - https://support.apple.com/en-us/121238 - https://support.apple.com/en-us/121247
CVE ID: CVE-2024-40848 State: PUBLISHED Published: 2024-09-16T23:23:29.232Z Last Updated: 2025-11-04T16:13:17.518Z Vendors: Apple Products: macOS Problem Types: An attacker may be able to read sensitive information Description: A downgrade issue was addressed with additional code-signing restrictions. This issue is fixed in macOS Ventura 13.7, macOS Sonoma 14.7, macOS Sequoia 15. An attacker may be able to read sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.apple.com/en-us/121234 - https://support.apple.com/en-us/121238 - https://support.apple.com/en-us/121247
CVE ID: CVE-2024-40850 State: PUBLISHED Published: 2024-09-16T23:22:21.900Z Last Updated: 2025-11-04T16:13:23.537Z Vendors: Apple Products: macOS, tvOS, visionOS, iOS and iPadOS, watchOS Problem Types: An app may be able to access user-sensitive data Description: A file access issue was addressed with improved input validation. This issue is fixed in macOS Ventura 13.7, iOS 17.7 and iPadOS 17.7, visionOS 2, watchOS 11, macOS Sequoia 15, iOS 18 and iPadOS 18, macOS Sonoma 14.7, tvOS 18. An app may be able to access user-sensitive data. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.apple.com/en-us/121234 - https://support.apple.com/en
lnrichment: - CVE Program Container: References: - https://support.apple.com/en-us/121234 - https://support.apple.com/en-us/121238 - https://support.apple.com/en-us/121248 - https://support.apple.com/en-us/121249 - https://support.apple.com/en-us/121246 - https://support.apple.com/en-us/121250 - https://support.apple.com/en-us/121247 - https://support.apple.com/en-us/121240
CVE ID: CVE-2024-40851 State: PUBLISHED Published: 2024-10-28T21:07:45.498Z Last Updated: 2025-11-03T21:57:18.425Z Vendors: Apple Products: iOS and iPadOS Problem Types: An attacker with physical access may be able to access contact photos from the lock screen Description: This issue was addressed by restricting options offered on a locked device. This issue is fixed in iOS 18.1 and iPadOS 18.1. An attacker with physical access may be able to access contact photos from the lock screen. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.apple.com/en-us/121563
CVE ID: CVE-2024-40852 State: PUBLISHED Published: 2024-09-16T23:23:22.334Z Last Updated: 2025-11-04T16:13:24.473Z Vendors: Apple Products: iOS and iPadOS Problem Types: An attacker may be able to see recent photos without authentication in Assistive Access Description: This issue was addressed by restricting options offered on a locked device. This issue is fixed in iOS 18 and iPadOS 18. An attacker may be able to see recent photos without authentication in Assistive Access. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.apple.com/en-us/121250
CVE ID: CVE-2024-40853 State: PUBLISHED Published: 2024-10-28T21:08:32.602Z Last Updated: 2024-10-29T19:15:54.596Z Vendors: Apple Products: iOS and iPadOS Problem Types: An attacker may be able to use Siri to enable Auto-Answer Calls Description: This issue was addressed by restricting options offered on a locked device. This issue is fixed in iOS 18 and iPadOS 18. An attacker may be able to use Siri to enable Auto-Answer Calls. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.apple.com/en-us/121250
CVE ID: CVE-2024-40854 State: PUBLISHED Published: 2025-01-15T19:35:59.681Z Last Updated: 2025-01-16T16:57:43.308Z Vendors: Apple Products: macOS, iOS and iPadOS Problem Types: An app may be able to cause unexpected system termination Description: A memory initialization issue was addressed with improved memory handling. This issue is fixed in iOS 18.1 and iPadOS 18.1, iOS 17.7.1 and iPadOS 17.7.1, macOS Sonoma 14.7.1, macOS Ventura 13.7.1. An app may be able to cause unexpected system termination. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.apple.com/en-us/121570 - https://support.apple.com/en-us/121567 - https://support.apple.com/en-us/121568 - https://
port.apple.com/en-us/121570 - https://support.apple.com/en-us/121567 - https://support.apple.com/en-us/121568 - https://support.apple.com/en-us/121563
CVE ID: CVE-2024-40855 State: PUBLISHED Published: 2024-10-28T21:08:13.758Z Last Updated: 2025-11-03T21:57:21.391Z Vendors: Apple Products: macOS Problem Types: A sandboxed app may be able to access sensitive user data Description: The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.7.1, macOS Sequoia 15, macOS Sonoma 14.7.1. A sandboxed app may be able to access sensitive user data. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.apple.com/en-us/121238 - https://support.apple.com/en-us/121570 - https://support.apple.com/en-us/121568
CVE ID: CVE-2024-40856 State: PUBLISHED Published: 2024-09-16T23:22:50.203Z Last Updated: 2025-11-04T16:13:27.305Z Vendors: Apple Products: macOS, tvOS, iOS and iPadOS Problem Types: An attacker may be able to force a device to disconnect from a secure network Description: An integrity issue was addressed with Beacon Protection. This issue is fixed in iOS 18 and iPadOS 18, tvOS 18, macOS Sequoia 15. An attacker may be able to force a device to disconnect from a secure network. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.apple.com/en-us/121238 - https://support.apple.com/en-us/121248 - https://support.apple.com/en-us/121250
CVE ID: CVE-2024-40857 State: PUBLISHED Published: 2024-09-16T23:22:32.092Z Last Updated: 2025-11-04T16:13:31.057Z Vendors: Apple Products: macOS, tvOS, visionOS, iOS and iPadOS, watchOS, Safari Problem Types: Processing maliciously crafted web content may lead to universal cross site scripting Description: This issue was addressed through improved state management. This issue is fixed in Safari 18, visionOS 2, watchOS 11, macOS Sequoia 15, iOS 18 and iPadOS 18, tvOS 18. Processing maliciously crafted web content may lead to universal cross site scripting. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.apple.com/en-us/121238 - https:
t Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.apple.com/en-us/121238 - https://support.apple.com/en-us/121248 - https://support.apple.com/en-us/121249 - https://support.apple.com/en-us/121250 - https://support.apple.com/en-us/121240 - https://support.apple.com/en-us/121241
CVE ID: CVE-2024-40859 State: PUBLISHED Published: 2024-09-16T23:23:01.051Z Last Updated: 2025-11-04T16:13:32.016Z Vendors: Apple Products: macOS Problem Types: An app may be able to access user-sensitive data Description: A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15. An app may be able to access user-sensitive data. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.apple.com/en-us/121238
CVE ID: CVE-2024-40860 State: PUBLISHED Published: 2024-09-16T23:22:41.618Z Last Updated: 2025-11-04T16:13:33.884Z Vendors: Apple Products: macOS Problem Types: An app may be able to modify protected parts of the file system Description: A logic issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.7, macOS Sequoia 15. An app may be able to modify protected parts of the file system. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.apple.com/en-us/121238 - https://support.apple.com/en-us/121247
CVE ID: CVE-2024-40861 State: PUBLISHED Published: 2024-09-16T23:22:35.793Z Last Updated: 2025-11-04T16:13:34.811Z Vendors: Apple Products: macOS Problem Types: An app may be able to gain root privileges Description: The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15. An app may be able to gain root privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.apple.com/en-us/121238
CVE ID: CVE-2024-40862 State: PUBLISHED Published: 2024-09-16T23:23:05.016Z Last Updated: 2025-11-04T16:13:35.763Z Vendors: Apple Products: Xcode Problem Types: An attacker may be able to determine the Apple ID of the owner of the computer Description: A privacy issue was addressed by removing sensitive data. This issue is fixed in Xcode 16. An attacker may be able to determine the Apple ID of the owner of the computer. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.apple.com/en-us/121239
CVE ID: CVE-2024-40863 State: PUBLISHED Published: 2024-09-16T23:23:04.055Z Last Updated: 2025-11-04T16:13:36.707Z Vendors: Apple Products: iOS and iPadOS Problem Types: An app may be able to leak sensitive user information Description: This issue was addressed with improved data protection. This issue is fixed in iOS 18 and iPadOS 18. An app may be able to leak sensitive user information. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.apple.com/en-us/121250
CVE ID: CVE-2024-40864 State: PUBLISHED Published: 2025-03-31T22:24:22.413Z Last Updated: 2025-11-03T20:38:24.319Z Vendors: Apple Products: macOS Problem Types: An attacker in a privileged network position can track a user's activity Description: The issue was addressed with improved handling of protocols. This issue is fixed in macOS Ventura 13.7.5, macOS Sonoma 14.7.5. An attacker in a privileged network position can track a user's activity. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.apple.com/en-us/122374 - https://support.apple.com/en-us/122375
CVE ID: CVE-2024-40865 State: PUBLISHED Published: 2024-09-06T01:23:53.981Z Last Updated: 2025-03-14T15:43:35.651Z Vendors: Apple Products: visionOS Problem Types: Inputs to the virtual keyboard may be inferred from Persona Description: The issue was addressed by suspending Persona when the virtual keyboard is active. This issue is fixed in visionOS 1.3. Inputs to the virtual keyboard may be inferred from Persona. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.apple.com/en-us/120915
CVE ID: CVE-2024-40866 State: PUBLISHED Published: 2024-09-16T23:22:28.243Z Last Updated: 2025-11-04T16:13:38.887Z Vendors: Apple Products: macOS, Safari Problem Types: Visiting a malicious website may lead to address bar spoofing Description: The issue was addressed with improved UI. This issue is fixed in Safari 18, macOS Sequoia 15. Visiting a malicious website may lead to address bar spoofing. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.apple.com/en-us/121238 - https://support.apple.com/en-us/121241
CVE ID: CVE-2024-40867 State: PUBLISHED Published: 2024-10-28T21:07:40.434Z Last Updated: 2025-11-03T21:57:24.305Z Vendors: Apple Products: iOS and iPadOS Problem Types: A remote attacker may be able to break out of Web Content sandbox Description: A custom URL scheme handling issue was addressed with improved input validation. This issue is fixed in iOS 18.1 and iPadOS 18.1. A remote attacker may be able to break out of Web Content sandbox. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.apple.com/en-us/121563
CVE ID: CVE-2024-40872 State: PUBLISHED Published: 2024-07-25T17:00:38.151Z Last Updated: 2024-08-02T04:39:55.376Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) Vendors: Absolute Security Products: Secure Access Problem Types: CWE-822 Description: There is an elevation of privilege vulnerability in server and client components of Absolute Secure Access prior to version 13.07. Attackers with local access and valid desktop user credentials can elevate their privilege to system level by passing invalid address data to the vulnerable component. This could be used to manipulate process tokens to elevate the privilege of a normal process to System. The scope is changed, th
ld be used to manipulate process tokens to elevate the privilege of a normal process to System. The scope is changed, the impact to system confidentiality and integrity is high, the impact to the availability of the effected component is none. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.absolute.com/platform/security-information/vulnerability-archive/secure-access-1307/cve-2024-40872/
CVE ID: CVE-2024-40873 State: PUBLISHED Published: 2024-07-25T17:19:28.906Z Last Updated: 2024-08-02T04:39:55.361Z Severity: MEDIUM (CVSS 4.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N) Vendors: Absolute Security Products: Secure Access Problem Types: CWE-79 Description: There is a cross-site scripting vulnerability in the Secure Access administrative console of Absolute Secure Access prior to version 13.07. Attackers with system administrator permissions can interfere with another system administrator’s use of the publishing UI when the administrators are editing the same management object. The scope is unchanged, there is no loss of confidentiality. Impact to system availability is none,
e management object. The scope is unchanged, there is no loss of confidentiality. Impact to system availability is none, impact to system integrity is high. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.absolute.com/platform/security-information/vulnerability-archive/secure-access-1307/cve-2024-40873/
CVE ID: CVE-2024-40875 State: PUBLISHED Published: 2024-12-20T20:17:27.132Z Last Updated: 2024-12-24T15:57:03.223Z Vendors: Absolute Software Products: Secure Access Problem Types: CWE-79 Description: There is a cross-site scripting vulnerability in the management console of Absolute Secure Access prior to version 13.52. Attackers with system administrator permissions can interfere with another system administrator’s use of the management console when the second administrator logs in. Attack complexity is high, attack requirements are present, privileges required are high, user interaction required is none. The impact to confidentiality is none, the impact to availability is low, and the imp
user interaction required is none. The impact to confidentiality is none, the impact to availability is low, and the impact to system integrity is high. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.absolute.com/platform/security-information/vulnerability-archive/secure-access-1352/
CVE ID: CVE-2024-40883 State: PUBLISHED Published: 2024-08-01T01:18:01.801Z Last Updated: 2025-02-17T05:38:38.595Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) Vendors: ELECOM CO.,LTD. Products: WRC-X1500GS-B, WRC-X1500GSA-B, WRC-X1800GS-B, WRC-X1800GSA-B, WRC-X1800GSH-B, WRC-X3000GS2-B, WRC-X3000GS2-W, WRC-X3000GS2A-B, WRC-XE5400GS-G, WRC-XE5400GSA-G, WRC-X6000QS-G, WRC-X6000QSA-G, WRC-X6000XS-G, WRC-X6000XST-G Problem Types: CWE-352 Description: Cross-site request forgery vulnerability exists in ELECOM wireless LAN routers. Viewing a malicious page while logging in to the affected product with an administrative privilege, the user may be directed to perform unin
page while logging in to the affected product with an administrative privilege, the user may be directed to perform unintended operations such as changing the login ID, login password, etc. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.elecom.co.jp/news/security/20240730-01/ - https://jvn.jp/en/jp/JVN06672778/
CVE ID: CVE-2024-40884 State: PUBLISHED Published: 2024-08-22T15:17:10.938Z Last Updated: 2024-08-22T18:08:37.730Z Severity: LOW (CVSS 2.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L) Vendors: Mattermost Products: Mattermost Problem Types: CWE-284 Description: Mattermost versions 9.5.x <= 9.5.7, 9.10.x <= 9.10.0 fail to properly enforce permissions which allows a team admin user without "Add Team Members" permission to disable the invite URL. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2024-40885 State: PUBLISHED Published: 2024-11-13T21:10:49.374Z Last Updated: 2024-11-14T19:42:12.756Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) Server M20NTP BIOS Problem Types: escalation of privilege, CWE-416 Description: Use after free in the UEFI firmware of some Intel(R) Server M20NTP BIOS may allow a privileged user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01175.html
CVE ID: CVE-2024-40886 State: PUBLISHED Published: 2024-08-22T06:32:11.786Z Last Updated: 2024-08-22T13:14:08.968Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L) Vendors: Mattermost Products: Mattermost Problem Types: CWE-352 Description: Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0, 9.8.x <= 9.8.2 fail to sanitize user inputs in the frontend that are used for redirection which allows for a one-click client-side path traversal that is leading to CSRF in User Management page of the system console. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2024-40887 State: PUBLISHED Published: 2025-02-12T21:20:06.116Z Last Updated: 2025-02-13T19:47:43.305Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H) Vendors: n/a Products: Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi software for Windows Problem Types: Denial of Service, CWE-362 Description: Race condition in some Intel(R) PROSet/Wireless WiFi and Killerâ„¢ WiFi software for Windows before version 23.80 may allow an unauthenticated user to potentially enable denial of service via adjacent access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01224.html
CVE ID: CVE-2024-40890 State: PUBLISHED Published: 2025-02-04T09:55:38.908Z Last Updated: 2025-10-21T22:55:30.414Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Zyxel Products: VMG4325-B10A firmware Problem Types: CWE-78 Description: **UNSUPPORTED WHEN ASSIGNED** A post-authentication command injection vulnerability in the CGI program of the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_20170615 could allow an authenticated attacker to execute operating system (OS) commands on an affected device by sending a crafted HTTP POST request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zyxel.com/global/en/support/
POST request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-and-insecure-default-credentials-vulnerabilities-in-certain-legacy-dsl-cpe-02-04-2025
CVE ID: CVE-2024-40891 State: PUBLISHED Published: 2025-02-04T10:02:48.018Z Last Updated: 2025-10-21T22:55:30.272Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Zyxel Products: VMG4325-B10A firmware Problem Types: CWE-78 Description: **UNSUPPORTED WHEN ASSIGNED** A post-authentication command injection vulnerability in the management commands of the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_20170615 could allow an authenticated attacker to execute operating system (OS) commands on an affected device via Telnet. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zyxel.com/global/en/support/security-advisories/
ional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-and-insecure-default-credentials-vulnerabilities-in-certain-legacy-dsl-cpe-02-04-2025
CVE ID: CVE-2024-40892 State: PUBLISHED Published: 2024-08-12T18:32:02.469Z Last Updated: 2024-08-21T17:13:00.297Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Firewalla Products: Box Software Problem Types: CWE-1391 Description: A weak credential vulnerability exists in Firewalla Box Software versions before 1.979. This vulnerability allows a physically close attacker to use the license UUID for authentication and provision SSH credentials over the Bluetooth Low-Energy (BTLE) interface. Once an attacker gains access to the LAN, they could log into the SSH interface using the provisioned credentials. The license UUID can be acquired through plain-text Bluet
log into the SSH interface using the provisioned credentials. The license UUID can be acquired through plain-text Bluetooth sniffing, reading the QR code on the bottom of the device, or brute-forcing the UUID (though this is less likely). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vulncheck.com/advisories/firewalla-bt-weak-credentials - https://www.labs.greynoise.io/grimoire/2024-08-20-bluuid-firewalla/
CVE ID: CVE-2024-40893 State: PUBLISHED Published: 2024-08-12T18:49:51.384Z Last Updated: 2024-08-21T17:13:39.202Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Firewalla Products: Box Software Problem Types: CWE-78 Description: Multiple authenticated operating system (OS) command injection vulnerabilities exist in Firewalla Box Software versions before 1.979. A physically close attacker that is authenticated to the Bluetooth Low-Energy (BTLE) interface can use the network configuration service to inject commands in various configuration parameters including networkConfig.Interface.Phy.Eth0.Extra.PingTestIP, networkConfig.Interface.Phy.Eth0.Extra.DNSTestDo
parameters including networkConfig.Interface.Phy.Eth0.Extra.PingTestIP, networkConfig.Interface.Phy.Eth0.Extra.DNSTestDomain, and networkConfig.Interface.Phy.Eth0.Gateway6. Additionally, because the configuration can be synced to the Firewalla cloud, the attacker may be able to persist access even after hardware resets and firmware re-flashes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vulncheck.com/advisories/firewalla-bt-command-injection - https://www.labs.greynoise.io/grimoire/2024-08-20-bluuid-firewalla/
CVE ID: CVE-2024-40895 State: PUBLISHED Published: 2024-07-30T08:37:07.607Z Last Updated: 2024-08-02T04:39:55.373Z Vendors: FFRI Security, Inc., NEC Corporation, Sky Co., Ltd. Products: FFRI AMC, FFRI AMC for ActSecure χ, EDR Plus Pack Problem Types: OS command injection Description: FFRI AMC versions 3.4.0 to 3.5.3 and some OEM products that implement/bundle FFRI AMC versions 3.4.0 to 3.5.3 allow a remote unauthenticated attacker to execute arbitrary OS commands when certain conditions are met in an environment where the notification program setting is enabled and the executable file path is set to a batch file (.bat) or command file (.cmd) extension. Additional Analyst Notes: - CISA ADP Vu
utable file path is set to a batch file (.bat) or command file (.cmd) extension. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ffri.jp/assets/files/other_docs/20240729.pdf - https://www.support.nec.co.jp/View.aspx?id=3140109694 - https://www.skyseaclientview.net/news/240729_01/ - https://jvn.jp/en/jp/JVN26734798/