Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-58135 State: PUBLISHED Published: 2025-05-03T10:16:10.636Z Last Updated: 2025-10-20T20:09:18.816Z Vendors: SRI Products: Mojolicious Problem Types: CWE-338 Description: Mojolicious versions from 7.28 for Perl will generate weak HMAC session cookie secrets via "mojo generate app" by default When creating a default app skeleton with the "mojo generate app" tool, a weak secret is written to the application's configuration file using the insecure rand() function, and used for authenticating and protecting the integrity of the application's sessions. This may allow an attacker to brute force the application's session keys. Additional Analyst Notes: - CISA ADP Vulnrichment: Refere
low an attacker to brute force the application's session keys. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://perldoc.perl.org/functions/rand - https://metacpan.org/release/SRI/Mojolicious-9.39/source/lib/Mojo/Util.pm#L181 - https://metacpan.org/release/SRI/Mojolicious-9.38/source/lib/Mojolicious/Command/Author/generate/app.pm#L202 - https://github.com/mojolicious/mojo/pull/2200 - https://metacpan.org/release/SRI/Mojolicious-7.28/source/lib/Mojolicious/Command/generate/app.pm#L220 - https://security.metacpan.org/docs/guides/random-data-for-security.html - https://github.com/hashcat/hashcat/pull/4090 - https://lists.debian.org/debian-perl/2025/05/msg00016.html - http
.html - https://github.com/hashcat/hashcat/pull/4090 - https://lists.debian.org/debian-perl/2025/05/msg00016.html - https://lists.debian.org/debian-perl/2025/05/msg00017.html - https://lists.debian.org/debian-perl/2025/05/msg00018.html
CVE ID: CVE-2024-58136 State: PUBLISHED Published: 2025-04-10T00:00:00.000Z Last Updated: 2025-10-21T22:55:21.228Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: yiiframework Products: Yii Problem Types: CWE-424 Description: Yii 2 before 2.0.52 mishandles the attaching of behavior that is defined by an __class array key, a CVE-2024-4990 regression, as exploited in the wild in February through April 2025. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/yiisoft/yii2/pull/20232 - https://github.com/yiisoft/yii2/pull/20232#issuecomment-2252459709 - https://github.com/yiisoft/yii2/commit/40fe496eda529fd1d933b56a1022ec32d3cd0b1
yii2/pull/20232#issuecomment-2252459709 - https://github.com/yiisoft/yii2/commit/40fe496eda529fd1d933b56a1022ec32d3cd0b12 - https://github.com/yiisoft/yii2/compare/2.0.51...2.0.52 - https://www.yiiframework.com/news/709/please-upgrade-to-yii-2-0-52
CVE ID: CVE-2024-58237 State: PUBLISHED Published: 2025-05-05T14:53:34.153Z Last Updated: 2025-05-09T08:06:10.185Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: bpf: consider that tail calls invalidate packet pointers Tail-called programs could execute any of the helpers that invalidate packet pointers. Hence, conservatively assume that each tail call invalidates packet pointers. Making the change in bpf_helper_changes_pkt_data() automatically makes use of check_cfg() logic that computes 'changes_pkt_data' effect for global sub-programs, such that the following program could be rejected: int tail_call(struct __sk_buff *sk) { b
fect for global sub-programs, such that the following program could be rejected: int tail_call(struct __sk_buff *sk) { bpf_tail_call_static(sk, &jmp_table, 0); return 0; } SEC("tc") int not_safe(struct __sk_buff *sk) { int *p = (void *)(long)sk->data; ... make p valid ... tail_call(sk); *p = 42; /* this is unsafe */ ... } The tc_bpf2bpf.c:subprog_tc() needs change: mark it as a function that can invalidate packet pointers. Otherwise, it can't be freplaced with tailcall_freplace.c:entry_freplace() that does a tail call. References: - https://git.kernel.org/stable/c/f1692ee23dcaaddc24ba407b269707ee5df1301f - https://git.kernel.org/stable/c/1c2244437f9ad3dd91215f920401a14f2542dbfc - https://git
dcaaddc24ba407b269707ee5df1301f - https://git.kernel.org/stable/c/1c2244437f9ad3dd91215f920401a14f2542dbfc - https://git.kernel.org/stable/c/1a4607ffba35bf2a630aab299e34dd3f6e658d70
CVE ID: CVE-2024-58238 State: PUBLISHED Published: 2025-08-09T14:31:47.079Z Last Updated: 2025-09-19T15:21:43.755Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btnxpuart: Resolve TX timeout error in power save stress test This fixes the tx timeout issue seen while running a stress test on btnxpuart for couple of hours, such that the interval between two HCI commands coincide with the power save timeout value of 2 seconds. Test procedure using bash script: <load btnxpuart.ko> hciconfig hci0 up //Enable Power Save feature hcitool -i hci0 cmd 3f 23 02 00 00 while (true) do hciconfig hci0 leadv sleep 2 hciconfig hci0 n
able Power Save feature hcitool -i hci0 cmd 3f 23 02 00 00 while (true) do hciconfig hci0 leadv sleep 2 hciconfig hci0 noleadv sleep 2 done Error log, after adding few more debug prints: Bluetooth: btnxpuart_queue_skb(): 01 0A 20 01 00 Bluetooth: hci0: Set UART break: on, status=0 Bluetooth: hci0: btnxpuart_tx_wakeup() tx_work scheduled Bluetooth: hci0: btnxpuart_tx_work() dequeue: 01 0A 20 01 00 Can't set advertise mode on hci0: Connection timed out (110) Bluetooth: hci0: command 0x200a tx timeout When the power save mechanism turns on UART break, and btnxpuart_tx_work() is scheduled simultaneously, psdata->ps_state is read as PS_STATE_AWAKE, which prevents the psdata->work from being sched
s scheduled simultaneously, psdata->ps_state is read as PS_STATE_AWAKE, which prevents the psdata->work from being scheduled, which is responsible to turn OFF UART break. This issue is fixed by adding a ps_lock mutex around UART break on/off as well as around ps_state read/write. btnxpuart_tx_wakeup() will now read updated ps_state value. If ps_state is PS_STATE_SLEEP, it will first schedule psdata->work, and then it will reschedule itself once UART break has been turned off and ps_state is PS_STATE_AWAKE. Tested above script for 50,000 iterations and TX timeout error was not observed anymore. References: - https://git.kernel.org/stable/c/9d5df94ce0e213d5b549633f528f96114c736190 - https://gi
ot observed anymore. References: - https://git.kernel.org/stable/c/9d5df94ce0e213d5b549633f528f96114c736190 - https://git.kernel.org/stable/c/e4db90e4eb8d5487098712ffb1048f3fa6d25e98
CVE ID: CVE-2024-58239 State: PUBLISHED Published: 2025-08-22T13:01:17.440Z Last Updated: 2025-08-22T13:01:17.440Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: tls: stop recv() if initial process_rx_list gave us non-DATA If we have a non-DATA record on the rx_list and another record of the same type still on the queue, we will end up merging them: - process_rx_list copies the non-DATA record - we start the loop and process the first available record since it's of the same type - we break out of the loop since the record was not DATA Just check the record type and jump to the end in case process_rx_list did some work. Referenc
e the record was not DATA Just check the record type and jump to the end in case process_rx_list did some work. References: - https://git.kernel.org/stable/c/f310143961e2d9a0479fca117ce869f8aaecc140 - https://git.kernel.org/stable/c/31e10d6cb0c9532ff070cf50da1657c3acee9276 - https://git.kernel.org/stable/c/4338032aa90bd1d5b33a4274e8fa8347cda5ee09 - https://git.kernel.org/stable/c/6756168add1c6c3ef1c32c335bb843a5d1f99a75 - https://git.kernel.org/stable/c/3b952d8fdfcf6fd8ea0b8954bc9277642cf0977f - https://git.kernel.org/stable/c/a4ed943882a8fc057ea5a67643314245e048bbdd - https://git.kernel.org/stable/c/fdfbaec5923d9359698cbb286bc0deadbb717504
CVE ID: CVE-2024-58240 State: PUBLISHED Published: 2025-08-28T09:40:33.466Z Last Updated: 2025-11-03T17:31:32.503Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: tls: separate no-async decryption request handling from async If we're not doing async, the handling is much simpler. There's no reference counting, we just need to wait for the completion to wake us up and return its result. We should preferably also use a separate crypto_wait. I'm not seeing a UAF as I did in the past, I think aec7961916f3 ("tls: fix race between async notify and socket close") took care of it. This will make the next fix easier. Additional Analyst N
x race between async notify and socket close") took care of it. This will make the next fix easier. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/48905146d11dbf1ddbb2967319016a83976953f5 - https://git.kernel.org/stable/c/dec5b6e7b211e405d3bcb504562ab21aa7e5a64d - https://git.kernel.org/stable/c/999115298017a675d8ddf61414fc7a85c89f1186 - https://git.kernel.org/stable/c/41532b785e9d79636b3815a64ddf6a096647d011
CVE ID: CVE-2024-58241 State: PUBLISHED Published: 2025-09-24T11:02:49.948Z Last Updated: 2025-09-24T11:02:49.948Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_core: Disable works on hci_unregister_dev This make use of disable_work_* on hci_unregister_dev since the hci_dev is about to be freed new submissions are not disarable. References: - https://git.kernel.org/stable/c/cfdb13a54e05eb98d9940cb6d1a13e7f994d811f - https://git.kernel.org/stable/c/989fa5171f005ecf63440057218d8aeb1795287d
CVE ID: CVE-2024-58248 State: PUBLISHED Published: 2025-04-16T00:00:00.000Z Last Updated: 2025-10-29T14:27:40.773Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N) Vendors: nopCommerce Products: nopCommerce Problem Types: CWE-362 Description: nopCommerce through 4.90.1 does not offer locking for order placement. Thus there is a race condition with duplicate redeeming of gift cards. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/nopSolutions/nopCommerce/issues/7325 - https://www.nopcommerce.com/en/release-notes - https://github.com/Fabian-For/Vulnerability-Research/blob/main/CVE-2024-58248/README.md
CVE ID: CVE-2024-58249 State: PUBLISHED Published: 2025-04-16T00:00:00.000Z Last Updated: 2025-04-17T14:21:41.743Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: wxWidgets Products: wxWidgets Problem Types: CWE-826 Description: In wxWidgets before 3.2.7, a crash can be triggered in wxWidgets apps when connections are refused in wxWebRequestCURL. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/wxWidgets/wxWidgets/issues/24885 - https://github.com/wxWidgets/wxWidgets/commit/f2918a9ac823074901ce27de939baa57788beb3d - https://github.com/wxWidgets/wxWidgets/compare/v3.2.6...v3.2.7
CVE ID: CVE-2024-58250 State: PUBLISHED Published: 2025-04-22T00:00:00.000Z Last Updated: 2025-04-22T02:08:05.615Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Samba Products: ppp Problem Types: CWE-426 Description: The passprompt plugin in pppd in ppp before 2.5.2 mishandles privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ppp-project/ppp/commit/0a66ad22e54c72690ec2a29a019767c55c5281fc - https://github.com/ppp-project/ppp/compare/v2.5.1...v2.5.2 - https://ppp.samba.org
CVE ID: CVE-2024-58251 State: PUBLISHED Published: 2025-04-23T00:00:00.000Z Last Updated: 2025-04-23T23:02:52.982Z Severity: LOW (CVSS 2.5 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: BusyBox Products: BusyBox Problem Types: CWE-150 Description: In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.busybox.net/downloads/ - https://www.busybox.net - https://bugs.busybox.net/show_bug.cgi?id=15922
CVE ID: CVE-2024-58252 State: PUBLISHED Published: 2025-05-06T07:15:24.968Z Last Updated: 2025-05-06T14:02:20.928Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Huawei Products: HarmonyOS Problem Types: CWE-200 Description: Vulnerability of insufficient information protection in the media library module Impact: Successful exploitation of this vulnerability may affect service confidentiality. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://consumer.huawei.com/en/support/bulletin/2025/5/
CVE ID: CVE-2024-58253 State: PUBLISHED Published: 2025-05-02T00:00:00.000Z Last Updated: 2025-05-05T14:58:49.162Z Severity: LOW (CVSS 2.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: CasualX Products: obfstr Problem Types: CWE-843 Description: In the obfstr crate before 0.4.4 for Rust, the obfstr! argument type is not restricted to string slices, leading to invalid UTF-8 conversion that produces an invalid value. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/CasualX/obfstr/issues/60 - https://github.com/CasualX/obfstr/compare/v0.4.3...v0.4.4
CVE ID: CVE-2024-58254 State: REJECTED Published: 2025-07-05T00:00:00.000Z Last Updated: 2025-07-05T03:24:15.402Z Description: No description available.
CVE ID: CVE-2024-58255 State: PUBLISHED Published: 2025-08-08T03:16:41.818Z Last Updated: 2025-08-08T16:25:08.280Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L) Vendors: Huawei Products: EnzoH-W5611T Problem Types: CWE-200 Description: EnzoH has an OS command injection vulnerability. Successful exploitation of this vulnerability may lead to arbitrary command execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.huawei.com/cn/psirt/security-advisories/2025/huawei-sa-ocivihep-e73ab538
CVE ID: CVE-2024-58256 State: PUBLISHED Published: 2025-08-08T03:14:34.270Z Last Updated: 2025-08-08T14:53:36.071Z Severity: MEDIUM (CVSS 4.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Huawei Products: EnzoH-W5611T Problem Types: CWE-200 Description: EnzoH has an OS command injection vulnerability. Successful exploitation of this vulnerability may lead to arbitrary command execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.huawei.com/cn/psirt/security-advisories/2025/huawei-sa-ocivihep-cn
CVE ID: CVE-2024-58257 State: PUBLISHED Published: 2025-08-08T03:15:50.173Z Last Updated: 2025-08-08T16:33:10.883Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L) Vendors: Huawei Products: EnzoH-W5611T Problem Types: CWE-200 Description: EnzoH has an OS command injection vulnerability. Successful exploitation of this vulnerability may lead to arbitrary command execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.huawei.com/cn/psirt/security-advisories/2025/huawei-sa-ocivihep-1bcbfffa
CVE ID: CVE-2024-58258 State: PUBLISHED Published: 2025-07-13T00:00:00.000Z Last Updated: 2025-11-03T19:34:25.863Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: SugarCRM Products: SugarCRM Problem Types: CWE-94 Description: SugarCRM before 13.0.4 and 14.x before 14.0.1 allows SSRF in the API module because a limited type of code injection can occur. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.sugarcrm.com/resources/security/sugarcrm-sa-2024-059/
CVE ID: CVE-2024-58259 State: PUBLISHED Published: 2025-09-02T11:53:03.928Z Last Updated: 2025-09-02T13:28:15.865Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H) Vendors: SUSE Products: rancher Problem Types: CWE-770 Description: A vulnerability has been identified within Rancher Manager in which it did not enforce request body size limits on certain public (unauthenticated) and authenticated API endpoints. This allows a malicious user to exploit this by sending excessively large payloads, which are fully loaded into memory during processing, leading to Denial of Service (DoS). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.suse.com/
to Denial of Service (DoS). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.suse.com/show_bug.cgi?id=CVE-2024-58259 - https://github.com/rancher/rancher/security/advisories/GHSA-4h45-jpvh-6p5j
CVE ID: CVE-2024-58260 State: PUBLISHED Published: 2025-10-02T12:09:46.203Z Last Updated: 2025-10-02T15:52:35.703Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:H) Vendors: SUSE Products: rancher Problem Types: CWE-863 Description: A vulnerability has been identified within Rancher Manager where a missing server-side validation on the `.username` field in Rancher can allow users with update permissions on other User resources to cause denial of access for targeted accounts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.suse.com/show_bug.cgi?id=CVE-2024-58260 - https://github.com/rancher/rancher/security/advisories/GHSA-q82v-h4rq-5c86
CVE ID: CVE-2024-58261 State: PUBLISHED Published: 2025-07-27T00:00:00.000Z Last Updated: 2025-07-28T18:55:28.197Z Severity: LOW (CVSS 2.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: sequoia-pgp Products: sequoia Problem Types: CWE-835 Description: The sequoia-openpgp crate 1.13.0 before 1.21.0 for Rust allows an infinite loop of "Reading a cert: Invalid operation: Not a Key packet" messages for RawCertParser operations that encounter an unsupported primary key type. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://rustsec.org/advisories/RUSTSEC-2024-0345.html - https://gitlab.com/sequoia-pgp/sequoia/-/issues/1106 - https://crates.io/crates/sequoia-openpgp
CVE ID: CVE-2024-58262 State: PUBLISHED Published: 2025-07-27T00:00:00.000Z Last Updated: 2025-07-28T18:55:22.149Z Severity: LOW (CVSS 2.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: dalek-cryptography Products: curve25519-dalek Problem Types: CWE-733 Description: The curve25519-dalek crate before 4.1.3 for Rust has a constant-time operation on elliptic curve scalars that is removed by LLVM. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://rustsec.org/advisories/RUSTSEC-2024-0344.html - https://github.com/dalek-cryptography/curve25519-dalek/pull/659 - https://crates.io/crates/curve25519-dalek
CVE ID: CVE-2024-58263 State: PUBLISHED Published: 2025-07-27T00:00:00.000Z Last Updated: 2025-07-28T18:55:15.988Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: CosmWasm Products: cosmwasm-std Problem Types: CWE-190 Description: The cosmwasm-std crate before 2.0.2 for Rust allows integer overflows that cause incorrect contract calculations. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://rustsec.org/advisories/RUSTSEC-2024-0338.html - https://github.com/CosmWasm/advisories/blob/main/CWAs/CWA-2024-002.md - https://crates.io/crates/cosmwasm-std
CVE ID: CVE-2024-58264 State: PUBLISHED Published: 2025-07-27T00:00:00.000Z Last Updated: 2025-07-28T15:06:17.073Z Severity: LOW (CVSS 3.2 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L) Vendors: CosmWasm Products: serde-json-wasm Problem Types: CWE-674 Description: The serde-json-wasm crate before 1.0.1 for Rust allows stack consumption via deeply nested JSON data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://rustsec.org/advisories/RUSTSEC-2024-0012.html - https://github.com/advisories/GHSA-rr69-rxr6-8qwf - https://crates.io/crates/serde-json-wasm
CVE ID: CVE-2024-58265 State: PUBLISHED Published: 2025-07-27T00:00:00.000Z Last Updated: 2025-07-28T15:05:47.523Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: mcginty Products: snow Problem Types: CWE-642 Description: The snow crate before 0.9.5 for Rust, when stateful TransportState is used, allows incrementing a nonce and thereby denying message delivery. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://rustsec.org/advisories/RUSTSEC-2024-0011.html - https://github.com/mcginty/snow/security/advisories/GHSA-7g9j-g5jg-3vv3 - https://crates.io/crates/snow
CVE ID: CVE-2024-58266 State: PUBLISHED Published: 2025-07-27T00:00:00.000Z Last Updated: 2025-07-28T15:03:56.004Z Severity: LOW (CVSS 3.2 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N) Vendors: comex Products: shlex Problem Types: CWE-116 Description: The shlex crate before 1.2.1 for Rust allows unquoted and unescaped instances of the { and \xa0 characters, which may facilitate command injection. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://rustsec.org/advisories/RUSTSEC-2024-0006.html - https://github.com/comex/rust-shlex/security/advisories/GHSA-r7qv-8r2h-pg27 - https://crates.io/crates/shlex
CVE ID: CVE-2024-58267 State: PUBLISHED Published: 2025-10-02T12:08:30.507Z Last Updated: 2025-10-03T03:55:35.943Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: SUSE Products: rancher Problem Types: CWE-345 Description: A vulnerability has been identified within Rancher Manager whereby the SAML authentication from the Rancher CLI tool is vulnerable to phishing attacks. The custom authentication protocol for SAML-based providers can be abused to steal Rancher’s authentication tokens. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.suse.com/show_bug.cgi?id=CVE-2024-58267 - https://github.com/rancher/rancher/security/advisories/G
s: - https://bugzilla.suse.com/show_bug.cgi?id=CVE-2024-58267 - https://github.com/rancher/rancher/security/advisories/GHSA-v3vj-5868-2ch2
CVE ID: CVE-2024-58269 State: PUBLISHED Published: 2025-10-29T14:58:06.640Z Last Updated: 2025-10-29T15:10:05.138Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: SUSE Products: rancher Problem Types: CWE-532 Description: A vulnerability has been identified in Rancher Manager, where sensitive information, including secret data, cluster import URLs, and registration tokens, is exposed to any entity with access to Rancher audit logs. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.suse.com/show_bug.cgi?id=CVE-2024-58269 - https://github.com/rancher/rancher/security/advisories/GHSA-mw39-9qc2-f7mg
CVE ID: CVE-2024-58272 State: REJECTED Published: 2025-10-30T21:26:13.848Z Last Updated: 2025-11-10T18:51:10.222Z Description: No description available.
CVE ID: CVE-2024-58273 State: PUBLISHED Published: 2025-10-30T21:24:15.621Z Last Updated: 2025-11-17T21:36:24.008Z Vendors: Nagios Products: Log Server Problem Types: CWE-266 Description: Nagios Log Server versions prior to 2024R1.0.2 contain a local privilege escalation vulnerability that allows an attacker who could execute commands as the Apache web user (or the backend shell user) to escalate to root on the host. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nagios.com/products/security/#log-server - https://www.nagios.com/changelog/#log-server-2024R1 - https://www.vulncheck.com/advisories/nagios-log-server-lpe-from-apache-backend-shell-user-to-root
CVE ID: CVE-2024-58274 State: PUBLISHED Published: 2025-10-22T00:00:00.000Z Last Updated: 2025-10-22T13:55:16.083Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L) Vendors: Hikvision Products: CSMP iSecure Center Problem Types: CWE-78 Description: Hikvision CSMP (Comprehensive Security Management Platform) iSecure Center through 2024-08-01 allows execution of a command within $( ) in /center/api/installation/detection JSON data, as exploited in the wild in 2024 and 2025. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ahisec/nuclei-tps/blob/main/http/vulnerabilities/hikvision/hikvision-csmp-installation-rce.yaml - https://forum.butian
m/ahisec/nuclei-tps/blob/main/http/vulnerabilities/hikvision/hikvision-csmp-installation-rce.yaml - https://forum.butian.net/article/498 - https://xz.aliyun.com/news/14639