Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-10198 State: PUBLISHED Published: 2024-10-21T01:00:06.467Z Last Updated: 2024-10-21T18:57:04.957Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N) Vendors: code-projects Products: Pharmacy Management System Problem Types: CWE-79 Description: A vulnerability was found in code-projects Pharmacy Management System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /manage_customer.php of the component Manage Customer Page. The manipulation of the argument suppliers_name/address leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The initi
scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The initial researcher advisory mentions contradicting files to be affected. Other parameters might be affected as well. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.281023 - https://vuldb.com/?ctiid.281023 - https://vuldb.com/?submit.426885 - https://gist.github.com/higordiego/93343006341d3799de0cb8912cc328ec - https://code-projects.org/
CVE ID: CVE-2024-10199 State: PUBLISHED Published: 2024-10-21T01:31:04.133Z Last Updated: 2024-10-21T13:39:42.129Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N) Vendors: code-projects Products: Pharmacy Management System Problem Types: CWE-79 Description: A vulnerability was found in code-projects Pharmacy Management System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /manage_medicine.php of the component Manage Medicines Page. The manipulation of the argument name/address/doctor_address/suppliers_name leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be use
o cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The initial researcher advisory mentions contradicting files to be affected. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.281024 - https://vuldb.com/?ctiid.281024 - https://vuldb.com/?submit.426916 - https://gist.github.com/higordiego/0dae6dd4a36acd12bcc408caf1c787d9 - https://code-projects.org/
CVE ID: CVE-2024-10200 State: PUBLISHED Published: 2024-10-21T03:09:19.964Z Last Updated: 2024-10-21T13:14:51.746Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Wellchoose Products: Administrative Management System Problem Types: CWE-23 Description: Administrative Management System from Wellchoose has a Path Traversal vulnerability, allowing unauthenticated remote attackers to exploit this vulnerability to download arbitrary files on the server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-8159-0f7a2-1.html - https://www.twcert.org.tw/en/cp-139-8158-dadbc-2.html
CVE ID: CVE-2024-10201 State: PUBLISHED Published: 2024-10-21T03:13:12.936Z Last Updated: 2024-10-21T13:13:10.337Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Wellchoose Products: Administrative Management System Problem Types: CWE-434 Description: Administrative Management System from Wellchoose does not properly validate uploaded file types, allowing remote attackers with regular privileges to upload and execute webshells. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-8160-756b6-1.html - https://www.twcert.org.tw/en/cp-139-8161-b8a6d-2.html
CVE ID: CVE-2024-10202 State: PUBLISHED Published: 2024-10-21T03:19:59.864Z Last Updated: 2024-11-06T15:50:46.778Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Wellchoose Products: Administrative Management System Problem Types: CWE-78 Description: Administrative Management System from Wellchoose has an OS Command Injection vulnerability, allowing remote attackers with regular privileges to inject and execute arbitrary OS commands. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-8162-dc491-1.html - https://www.twcert.org.tw/en/cp-139-8163-b701e-2.html
CVE ID: CVE-2024-10203 State: PUBLISHED Published: 2024-11-07T09:20:07.450Z Last Updated: 2024-11-07T14:27:15.677Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: ManageEngine Products: EndPoint Central Problem Types: CWE-269 Description: Zohocorp ManageEngine EndPoint Central versions 11.3.2416.21 and below, 11.3.2428.9 and below are vulnerable to Arbitrary File Deletion in the agent installed machines. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.manageengine.com/products/desktop-central/cve-2024-10203.html
CVE ID: CVE-2024-10204 State: PUBLISHED Published: 2024-11-19T13:15:41.223Z Last Updated: 2024-11-19T14:09:14.475Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Dassault Systèmes Products: eDrawings Problem Types: CWE-122, CWE-457 Description: Heap-based Buffer Overflow and Uninitialized Variable vulnerabilities exist in the X_B and SAT file reading procedure in eDrawings from Release SOLIDWORKS 2024 through Release SOLIDWORKS 2025. These vulnerabilities could allow an attacker to execute arbitrary code while opening a specially crafted X_B or SAT file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.3ds.com/vulnerability/advisor
or SAT file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.3ds.com/vulnerability/advisories
CVE ID: CVE-2024-10205 State: PUBLISHED Published: 2024-12-17T01:16:19.301Z Last Updated: 2024-12-17T14:57:23.929Z Severity: CRITICAL (CVSS 9.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H) Vendors: Hitachi Products: Hitachi Ops Center Analyzer, Hitachi Infrastructure Analytics Advisor Problem Types: CWE-306 Description: Authentication Bypass vulnerability in Hitachi Ops Center Analyzer on Linux, 64 bit (Hitachi Ops Center Analyzer detail view component), Hitachi Infrastructure Analytics Advisor on Linux, 64 bit (Hitachi Data Center Analytics component ).This issue affects Hitachi Ops Center Analyzer: from 10.0.0-00 before 11.0.3-00; Hitachi Infrastructure Analytics Advisor: from 2.1.0-00 th
Hitachi Ops Center Analyzer: from 10.0.0-00 before 11.0.3-00; Hitachi Infrastructure Analytics Advisor: from 2.1.0-00 through 4.4.0-00. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2024-151/index.html
CVE ID: CVE-2024-10206 State: PUBLISHED Published: 2025-03-25T04:33:03.909Z Last Updated: 2025-03-25T13:21:55.541Z Vendors: B&R Industrial Automation GmbH Products: APROL Problem Types: CWE-918 Description: A Server-Side Request Forgery vulnerability in the APROL Web Portal used in B&R APROL <4.4-00P5 may allow an unauthenticated network-based attacker to force the web server to request arbitrary URLs. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.br-automation.com/fileadmin/SA24P015-77573c08.pdf
CVE ID: CVE-2024-10207 State: PUBLISHED Published: 2025-03-25T04:42:41.365Z Last Updated: 2025-03-25T13:19:18.439Z Vendors: B&R Industrial Automation GmbH Products: APROL Problem Types: CWE-918 Description: A Server-Side Request Forgery vulnerability in the APROL Web Portal used in B&R APROL <4.4-00P5 may allow an authenticated network-based attacker to force the web server to request arbitrary URLs. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.br-automation.com/fileadmin/SA24P015-77573c08.pdf
CVE ID: CVE-2024-10208 State: PUBLISHED Published: 2025-03-25T04:43:41.038Z Last Updated: 2025-03-25T13:18:32.467Z Vendors: B&R Industrial Automation GmbH Products: APROL Problem Types: CWE-79 Description: An Improper Neutralization of Input During Web Page Generation vulnerability in the APROL Web Portal used in B&R APROL <4.4-00P5 may allow an authenticated network-based attacker to insert malicious code which is then executed in the context of the user’s browser session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.br-automation.com/fileadmin/SA24P015-77573c08.pdf
CVE ID: CVE-2024-10209 State: PUBLISHED Published: 2025-03-25T04:46:50.392Z Last Updated: 2025-03-25T14:33:06.382Z Vendors: B&R Industrial Automation GmbH Products: APROL Problem Types: CWE-732 Description: An Incorrect Permission Assignment for Critical Resource vulnerability in the file system used in B&R APROL <4.4-01 may allow an authenticated local attacker to read and alter the configuration of another engineering or runtime user. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.br-automation.com/fileadmin/SA24P015-77573c08.pdf
CVE ID: CVE-2024-10210 State: PUBLISHED Published: 2025-03-25T05:32:38.666Z Last Updated: 2025-03-31T18:00:27.265Z Vendors: B&R Industrial Automation GmbH Products: APROL Problem Types: CWE-73 Description: An External Control of File Name or Path vulnerability in the APROL Web Portal used in B&R APROL <4.4-005P may allow an authenticated network-based attacker to access data from the file system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.br-automation.com/fileadmin/SA24P015-77573c08.pdf
CVE ID: CVE-2024-10212 State: REJECTED Published: N/A Last Updated: 2025-07-05T22:16:35.050Z Description: No description available.
CVE ID: CVE-2024-10214 State: PUBLISHED Published: 2024-10-28T14:12:37.346Z Last Updated: 2024-10-28T14:55:50.766Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N) Vendors: Mattermost Products: Mattermost Problem Types: CWE-303 Description: Mattermost versions 9.11.X <= 9.11.1, 9.5.x <= 9.5.9 icorrectly issues two sessions when using desktop SSO - one in the browser and one in desktop with incorrect settings. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2024-10215 State: PUBLISHED Published: 2025-01-09T19:21:56.597Z Last Updated: 2025-01-09T20:07:20.273Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Iqonic Design Products: WPBookit Problem Types: CWE-639 Description: The WPBookit plugin for WordPress is vulnerable to Arbitrary User Password Change in versions up to, and including, 1.6.4. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system resources. This makes it possible for unauthenticated attackers to change user passwords and potentially take over administrator accounts. Additional Analyst Notes: - CISA ADP Vulnrich
to change user passwords and potentially take over administrator accounts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2d23a2b9-8476-4564-a5de-5e6cfc38ce68?source=cve - https://documentation.iqonic.design/wpbookit/versions/change-log
CVE ID: CVE-2024-10216 State: PUBLISHED Published: 2024-11-23T03:25:47.933Z Last Updated: 2024-11-23T13:28:21.147Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: wpusermanager Products: WP User Manager – User Profile Builder & Membership Problem Types: CWE-862 Description: The WP User Manager – User Profile Builder & Membership plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'add_sidebar' and 'remove_sidebar' functions in all versions up to, and including, 2.9.11. This makes it possible for authenticated attackers, with Subscriber-level access and above, to add or remove a Carbon Fields custom
it possible for authenticated attackers, with Subscriber-level access and above, to add or remove a Carbon Fields custom sidebar if the Carbon Fields (carbon-fields) plugin is installed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3ab4e9c6-68b0-4113-bff0-c1d3c2d3dea4?source=cve - https://plugins.trac.wordpress.org/browser/wp-user-manager/trunk/vendor-dist/htmlburger/carbon-fields/core/Libraries/Sidebar_Manager/Sidebar_Manager.php#L79 - https://plugins.trac.wordpress.org/browser/wp-user-manager/trunk/vendor-dist/htmlburger/carbon-fields/core/Libraries/Sidebar_Manager/Sidebar_Manager.php#L102 - https://plugins.trac.
unk/vendor-dist/htmlburger/carbon-fields/core/Libraries/Sidebar_Manager/Sidebar_Manager.php#L102 - https://plugins.trac.wordpress.org/changeset/3194404/wp-user-manager/trunk/includes/class-wp-user-manager.php
CVE ID: CVE-2024-10217 State: PUBLISHED Published: 2024-11-12T19:12:54.360Z Last Updated: 2024-11-21T16:15:44.718Z Vendors: TIBCO Software Inc Products: TIBCO Hawk, TIBCO Operational Intelligence Problem Types: The components listed above contain a vulnerability that allows the author of a malicious .mar file to perform an XSS attack Description: XSS Attack in mar.jar, Monitoring Archive Utility (MAR Utility), monitoringconsolecommon.jar in TIBCO Software Inc TIBCO Hawk and TIBCO Operational Intelligence Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://community.tibco.com/advisories
CVE ID: CVE-2024-10218 State: PUBLISHED Published: 2024-11-12T19:14:00.748Z Last Updated: 2024-11-22T20:41:19.178Z Vendors: TIBCO Software Inc Products: TIBCO Hawk, TIBCO Operational Intelligence Problem Types: The components listed above contain a vulnerability that allows the author of a malicious .mar file to perform an XEE attack Description: XSS Attack in mar.jar, Monitoring Archive Utility (MAR Utility), monitoringconsolecommon.jar in TIBCO Software Inc TIBCO Hawk and TIBCO Operational Intelligence Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://community.tibco.com/advisories
CVE ID: CVE-2024-10219 State: PUBLISHED Published: 2025-08-13T17:28:00.498Z Last Updated: 2025-08-13T19:59:02.008Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-863 Description: An issue has been discovered in GitLab CE/EE affecting all versions from 15.6 before 18.0.6, 18.1 before 18.1.4, and 18.2 before 18.2.2 that under certain conditions could have allowed authenticated users to bypass access controls and download private artifacts by accessing specific API endpoints. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/500134 - https://hackerone.com/re
: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/500134 - https://hackerone.com/reports/2780353
CVE ID: CVE-2024-10220 State: PUBLISHED Published: 2024-11-22T16:23:00.535Z Last Updated: 2024-11-25T18:22:59.457Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: Kubernetes Products: kubelet Problem Types: CWE-22 Description: The Kubernetes kubelet component allows arbitrary command execution via specially crafted gitRepo volumes.This issue affects kubelet: through 1.28.11, from 1.29.0 through 1.29.6, from 1.30.0 through 1.30.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/kubernetes/kubernetes/issues/128885 - https://groups.google.com/g/kubernetes-security-announce/c/ptNgV5Necko
CVE ID: CVE-2024-10222 State: PUBLISHED Published: 2025-02-21T13:41:28.666Z Last Updated: 2025-02-21T17:16:47.682Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: benbodhi Products: SVG Support Problem Types: CWE-79 Description: The SVG Support plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.5.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. By default, this can only be exploited by a
eb scripts in pages that will execute whenever a user accesses the SVG file. By default, this can only be exploited by administrators, but the ability to upload SVG files can be extended to authors. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5852f08d-0506-464e-afd1-c625e4034e1d?source=cve - https://wordpress.org/plugins/svg-support/#developers - https://plugins.trac.wordpress.org/changeset/3244181/ - https://github.com/benbodhi/svg-support/commit/eee3e13b650511c9cc9ee0746be485d031c7c072
CVE ID: CVE-2024-10223 State: PUBLISHED Published: 2024-10-30T06:43:36.000Z Last Updated: 2024-10-30T13:01:33.187Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: htplugins Products: WP Team – WordPress Team Member Plugin Problem Types: CWE-79 Description: The WP Team – WordPress Team Member Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's htteamember shortcode in all versions up to, and including, 1.1.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in p
s it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2f5a8f5b-d67c-4c08-9f2d-1f743ffdae81?source=cve - https://wordpress.org/plugins/ht-team-member/#developers - https://plugins.trac.wordpress.org/changeset/3177675/
CVE ID: CVE-2024-10224 State: PUBLISHED Published: 2024-11-19T17:35:25.014Z Last Updated: 2025-11-03T21:51:05.694Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Module::ScanDeps Products: Module::ScanDeps Description: Qualys discovered that if unsanitized input was used with the library Modules::ScanDeps, before version 1.36 a local attacker could possibly execute arbitrary shell commands by open()ing a "pesky pipe" (such as passing "commands|" as a filename) or by passing arbitrary strings to eval(). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cve.org/CVERecord?id=CVE-2024-10224 - https://github.co
am Container: - CISA ADP Vulnrichment: References: - https://www.cve.org/CVERecord?id=CVE-2024-10224 - https://github.com/rschupp/Module-ScanDeps/security/advisories/GHSA-g597-359q-v529 - https://www.qualys.com/2024/11/19/needrestart/needrestart.txt
CVE ID: CVE-2024-10225 State: PUBLISHED Published: 2025-03-20T10:08:54.041Z Last Updated: 2025-10-15T12:49:22.767Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: haotian-liu Products: haotian-liu/llava Problem Types: CWE-770 Description: A vulnerability in haotian-liu/llava v1.2.0 allows an attacker to cause a Denial of Service (DoS) by appending a large number of characters to the end of a multipart boundary in a file upload request. This causes the server to continuously process each character, rendering the application inaccessible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/cd793f83-f122-432b-83e7-1cc8c7881
ional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/cd793f83-f122-432b-83e7-1cc8c78817b7
CVE ID: CVE-2024-10226 State: PUBLISHED Published: 2024-10-29T13:53:56.507Z Last Updated: 2024-10-29T14:49:11.897Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: tychesoftwares Products: Arconix Shortcodes Problem Types: CWE-79 Description: The Arconix Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'box' shortcode in all versions up to, and including, 2.1.13 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user a
s, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/94bae97d-2959-4ace-992d-1f4b1ccc8c3b?source=cve - https://wordpress.org/plugins/arconix-shortcodes/#developers - https://plugins.trac.wordpress.org/changeset/3176718/
CVE ID: CVE-2024-10227 State: PUBLISHED Published: 2024-10-29T09:31:30.860Z Last Updated: 2024-10-29T14:51:05.852Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: cservit Products: affiliate-toolkit Problem Types: CWE-79 Description: The affiliate-toolkit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's atkp_product shortcode in all versions up to, and including, 3.6.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user acce
with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7f86568f-dcdd-44fb-905a-9c5474f56515?source=cve - https://wordpress.org/plugins/affiliate-toolkit-starter/#developers - https://plugins.trac.wordpress.org/changeset/3174286/ - https://servit.dev/
CVE ID: CVE-2024-10228 State: PUBLISHED Published: 2024-10-29T21:18:13.145Z Last Updated: 2024-10-30T13:25:02.816Z Severity: LOW (CVSS 3.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N) Vendors: HashiCorp Products: Vagrant Problem Types: CWE-732 Description: The Vagrant VMWare Utility Windows installer targeted a custom location with a non-protected path that could be modified by an unprivileged user, introducing potential for unauthorized file system writes. This vulnerability, CVE-2024-10228, was fixed in Vagrant VMWare Utility 1.0.23 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://discuss.hashicorp.com/t/hcsec-2024-25-vagrant-vmware-utility-installation-files-vulne
ulnrichment: References: - https://discuss.hashicorp.com/t/hcsec-2024-25-vagrant-vmware-utility-installation-files-vulnerable-to-modification-by-unprivileged-user
CVE ID: CVE-2024-10229 State: PUBLISHED Published: 2024-10-22T21:43:10.643Z Last Updated: 2024-10-30T03:55:21.562Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Inappropriate implementation in Extensions in Google Chrome prior to 130.0.6723.69 allowed a remote attacker to bypass site isolation via a crafted Chrome Extension. (Chromium security severity: High) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2024/10/stable-channel-update-for-desktop_22.html - https://issues.chromium.org/issues/371011220
CVE ID: CVE-2024-10230 State: PUBLISHED Published: 2024-10-22T21:43:11.083Z Last Updated: 2024-10-30T03:55:23.186Z Vendors: Google Products: Chrome Problem Types: CWE-843 Description: Type Confusion in V8 in Google Chrome prior to 130.0.6723.69 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2024/10/stable-channel-update-for-desktop_22.html - https://issues.chromium.org/issues/371565065