Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-36478 State: PUBLISHED Published: 2024-06-21T10:18:09.027Z Last Updated: 2025-11-03T21:55:17.674Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: null_blk: fix null-ptr-dereference while configuring 'power' and 'submit_queues' Writing 'power' and 'submit_queues' concurrently will trigger kernel panic: Test script: modprobe null_blk nr_devices=0 mkdir -p /sys/kernel/config/nullb/nullb0 while true; do echo 1 > submit_queues; echo 4 > submit_queues; done & while true; do echo 1 > power; echo 0 > power; done Test result: BUG: kernel NULL pointer dereference, address: 0000000000000148 Oops: 0000 [#1] PREEMPT SMP RIP:
ower; done Test result: BUG: kernel NULL pointer dereference, address: 0000000000000148 Oops: 0000 [#1] PREEMPT SMP RIP: 0010:__lock_acquire+0x41d/0x28f0 Call Trace: <TASK> lock_acquire+0x121/0x450 down_write+0x5f/0x1d0 simple_recursive_removal+0x12f/0x5c0 blk_mq_debugfs_unregister_hctxs+0x7c/0x100 blk_mq_update_nr_hw_queues+0x4a3/0x720 nullb_update_nr_hw_queues+0x71/0xf0 [null_blk] nullb_device_submit_queues_store+0x79/0xf0 [null_blk] configfs_write_iter+0x119/0x1e0 vfs_write+0x326/0x730 ksys_write+0x74/0x150 This is because del_gendisk() can concurrent with blk_mq_update_nr_hw_queues(): nullb_device_power_store nullb_apply_submit_queues null_del_dev del_gendisk nullb_update_nr_hw_queues if
nr_hw_queues(): nullb_device_power_store nullb_apply_submit_queues null_del_dev del_gendisk nullb_update_nr_hw_queues if (!dev->nullb) // still set while gendisk is deleted return 0 blk_mq_update_nr_hw_queues dev->nullb = NULL Fix this problem by resuing the global mutex to protect nullb_device_power_store() and nullb_update_nr_hw_queues() from configfs. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/1d4c8baef435c98e8d5aa7027dc5a9f70834ba16 - https://git.kernel.org/stable/c/aaadb755f2d684f715a6eb85cb7243aa0c67dfa9 - https://git.kernel.org/stable/c/5d0495473ee4c1d041b5a917f10446a22c047f47 - https://git.kernel.org/stabl
7243aa0c67dfa9 - https://git.kernel.org/stable/c/5d0495473ee4c1d041b5a917f10446a22c047f47 - https://git.kernel.org/stable/c/a2db328b0839312c169eb42746ec46fc1ab53ed2
CVE ID: CVE-2024-36479 State: PUBLISHED Published: 2024-06-24T13:56:51.367Z Last Updated: 2025-11-03T20:37:46.921Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: fpga: bridge: add owner module and take its refcount The current implementation of the fpga bridge assumes that the low-level module registers a driver for the parent device and uses its owner pointer to take the module's refcount. This approach is problematic since it can lead to a null pointer dereference while attempting to get the bridge if the parent device does not have a driver. To address this problem, add a module owner pointer to the fpga_bridge struct and us
rent device does not have a driver. To address this problem, add a module owner pointer to the fpga_bridge struct and use it to take the module's refcount. Modify the function for registering a bridge to take an additional owner module parameter and rename it to avoid conflicts. Use the old function name for a helper macro that automatically sets the module that registers the bridge as the owner. This ensures compatibility with existing low-level control modules and reduces the chances of registering a bridge without setting the owner. Also, update the documentation to keep it consistent with the new interface for registering an fpga bridge. Other changes: opportunistically move put_device()
it consistent with the new interface for registering an fpga bridge. Other changes: opportunistically move put_device() from __fpga_bridge_get() to fpga_bridge_get() and of_fpga_bridge_get() to improve code clarity since the bridge device is taken in these functions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/18dc8366abb6cadcb77668b1a16434654e355d49 - https://git.kernel.org/stable/c/d7c4081c54a1d4068de9440957303a76f9e5c95b - https://git.kernel.org/stable/c/6896b6b2e2d9ec4e1b0acb4c1698a75a4b34d125 - https://git.kernel.org/stable/c/1da11f822042eb6ef4b6064dc048f157a7852529
CVE ID: CVE-2024-36480 State: PUBLISHED Published: 2024-06-19T06:40:46.619Z Last Updated: 2024-08-02T03:37:05.325Z Vendors: CVE-2024-36480 Products: Ricoh Streamline NX PC Client Problem Types: Use of Hard-coded Credentials Description: Use of hard-coded credentials issue exists in Ricoh Streamline NX PC Client ver.3.7.2 and earlier. If this vulnerability is exploited, an attacker may obtain LocalSystem Account of the PC where the product is installed. As a result, unintended operations may be performed on the PC. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ricoh.com/products/security/vulnerabilities/vul?id=ricoh-2024-000005 - https:/
gram Container: References: - https://www.ricoh.com/products/security/vulnerabilities/vul?id=ricoh-2024-000005 - https://jvn.jp/en/jp/JVN00442488/
CVE ID: CVE-2024-36481 State: PUBLISHED Published: 2024-06-21T11:18:47.482Z Last Updated: 2025-05-04T09:11:15.637Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: tracing/probes: fix error check in parse_btf_field() btf_find_struct_member() might return NULL or an error via the ERR_PTR() macro. However, its caller in parse_btf_field() only checks for the NULL condition. Fix this by using IS_ERR() and returning the error up the stack. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/ad4b202da2c498fefb69e5d87f67b946e7fe1e6a - https://git.kernel.org/stable/c/4
ferences: - https://git.kernel.org/stable/c/ad4b202da2c498fefb69e5d87f67b946e7fe1e6a - https://git.kernel.org/stable/c/4ed468edfeb54c7202e559eba74c25fac6a0dad0 - https://git.kernel.org/stable/c/e569eb34970281438e2b48a3ef11c87459fcfbcb
CVE ID: CVE-2024-36482 State: PUBLISHED Published: 2024-11-13T21:11:33.988Z Last Updated: 2024-11-14T19:39:43.978Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) CIP software Problem Types: escalation of privilege, CWE-20 Description: Improper input validation in some Intel(R) CIP software before version 2.4.10852 may allow a privileged user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01182.html
CVE ID: CVE-2024-36484 State: PUBLISHED Published: 2024-06-21T10:18:09.672Z Last Updated: 2025-05-04T12:56:22.074Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net: relax socket state check at accept time. Christoph reported the following splat: WARNING: CPU: 1 PID: 772 at net/ipv4/af_inet.c:761 __inet_accept+0x1f4/0x4a0 Modules linked in: CPU: 1 PID: 772 Comm: syz-executor510 Not tainted 6.9.0-rc7-g7da7119fe22b #56 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-2.el7 04/01/2014 RIP: 0010:__inet_accept+0x1f4/0x4a0 net/ipv4/af_inet.c:759 Code: 04 38 84 c0 0f 85 87 00 00 00 41 c7 04 24 03 00 00 00 48 83 c4 1
:__inet_accept+0x1f4/0x4a0 net/ipv4/af_inet.c:759 Code: 04 38 84 c0 0f 85 87 00 00 00 41 c7 04 24 03 00 00 00 48 83 c4 10 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc e8 ec b7 da fd <0f> 0b e9 7f fe ff ff e8 e0 b7 da fd 0f 0b e9 fe fe ff ff 89 d9 80 RSP: 0018:ffffc90000c2fc58 EFLAGS: 00010293 RAX: ffffffff836bdd14 RBX: 0000000000000000 RCX: ffff888104668000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: dffffc0000000000 R08: ffffffff836bdb89 R09: fffff52000185f64 R10: dffffc0000000000 R11: fffff52000185f64 R12: dffffc0000000000 R13: 1ffff92000185f98 R14: ffff88810754d880 R15: ffff8881007b7800 FS: 000000001c772880(0000) GS:ffff88811b280000(0000) knlGS:0000000000000000
R14: ffff88810754d880 R15: ffff8881007b7800 FS: 000000001c772880(0000) GS:ffff88811b280000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fb9fcf2e178 CR3: 00000001045d2002 CR4: 0000000000770ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: <TASK> inet_accept+0x138/0x1d0 net/ipv4/af_inet.c:786 do_accept+0x435/0x620 net/socket.c:1929 __sys_accept4_file net/socket.c:1969 [inline] __sys_accept4+0x9b/0x110 net/socket.c:1999 __do_sys_accept net/socket.c:2016 [inline] __se_sys_accept net/socket.c:2013 [inline] __x64_sys_accept+0x7d/0x90 net/socket
o_sys_accept net/socket.c:2016 [inline] __se_sys_accept net/socket.c:2013 [inline] __x64_sys_accept+0x7d/0x90 net/socket.c:2013 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x58/0x100 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x4315f9 Code: fd ff 48 81 c4 80 00 00 00 e9 f1 fe ff ff 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 ab b4 fd ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007ffdb26d9c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002b RAX: ffffffffffffffda RBX: 0000000000400300 RCX: 00000000004315f9 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004 RBP: 0
fda RBX: 0000000000400300 RCX: 00000000004315f9 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004 RBP: 00000000006e1018 R08: 0000000000400300 R09: 0000000000400300 R10: 0000000000400300 R11: 0000000000000246 R12: 0000000000000000 R13: 000000000040cdf0 R14: 000000000040ce80 R15: 0000000000000055 </TASK> The reproducer invokes shutdown() before entering the listener status. After commit 94062790aedb ("tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets"), the above causes the child to reach the accept syscall in FIN_WAIT1 status. Eric noted we can relax the existing assertion in __inet_accept() Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container:
x the existing assertion in __inet_accept() Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/7de00adc9bd035d861ba4177848ca0bfa5ed1e04 - https://git.kernel.org/stable/c/59801e88c99f7c3f44a4d20af6ba6417aa359b5d - https://git.kernel.org/stable/c/6e03006548c66b979f4e5e9fc797aac4dad82822 - https://git.kernel.org/stable/c/21c14c556cccd0cb54b71ec5e901e64ba84c7165 - https://git.kernel.org/stable/c/c09ddc605893df542c6cf8dde6a57a93f7cf0adb - https://git.kernel.org/stable/c/87bdc9f6f58b4417362d6932b49b828e319f97dc - https://git.kernel.org/stable/c/5f9a04a94fd1894d7009055ab8e5832a0242dba3 - https://git.kernel.org/stable/c/26afda78c
c - https://git.kernel.org/stable/c/5f9a04a94fd1894d7009055ab8e5832a0242dba3 - https://git.kernel.org/stable/c/26afda78cda3da974fd4c287962c169e9462c495
CVE ID: CVE-2024-36485 State: PUBLISHED Published: 2024-11-04T11:13:02.838Z Last Updated: 2024-11-07T11:02:05.293Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L) Vendors: ManageEngine Products: ADAudit Plus Problem Types: CWE-89 Description: Zohocorp ManageEngine ADAudit Plus versions below 8121 are vulnerable to SQL Injection in Technician reports option. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.manageengine.com/products/active-directory-audit/cve-2024-36485.html
CVE ID: CVE-2024-36486 State: PUBLISHED Published: 2025-06-03T09:43:26.596Z Last Updated: 2025-06-03T13:22:13.518Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Parallels Products: Parallels Desktop for Mac Problem Types: CWE-62 Description: A privilege escalation vulnerability exists in the virtual machine archive restoration functionality of Parallels Desktop for Mac version 20.1.1 (55740). When an archived virtual machine is restored, the prl_vmarchiver tool decompresses the file and writes the content back to its original location using root privileges. An attacker can exploit this process by using a hard link to write to an arbitrary file, potentially r
root privileges. An attacker can exploit this process by using a hard link to write to an arbitrary file, potentially resulting in privilege escalation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2024-2126
CVE ID: CVE-2024-36488 State: PUBLISHED Published: 2024-11-13T21:11:56.887Z Last Updated: 2024-11-14T19:37:43.476Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) DSA Problem Types: escalation of privilege, CWE-284 Description: Improper Access Control in some Intel(R) DSA before version 24.3.26.8 may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01200.html
CVE ID: CVE-2024-36489 State: PUBLISHED Published: 2024-06-21T10:18:10.327Z Last Updated: 2025-05-04T09:11:17.796Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: tls: fix missing memory barrier in tls_init In tls_init(), a write memory barrier is missing, and store-store reordering may cause NULL dereference in tls_{setsockopt,getsockopt}. CPU0 CPU1 ----- ----- // In tls_init() // In tls_ctx_create() ctx = kzalloc() ctx->sk_proto = READ_ONCE(sk->sk_prot) -(1) // In update_sk_prot() WRITE_ONCE(sk->sk_prot, tls_prots) -(2) // In sock_common_setsockopt() READ_ONCE(sk->sk_prot)->setsockopt() // In tls_{setsockopt,getsockopt}() ctx-
prots) -(2) // In sock_common_setsockopt() READ_ONCE(sk->sk_prot)->setsockopt() // In tls_{setsockopt,getsockopt}() ctx->sk_proto->setsockopt() -(3) In the above scenario, when (1) and (2) are reordered, (3) can observe the NULL value of ctx->sk_proto, causing NULL dereference. To fix it, we rely on rcu_assign_pointer() which implies the release barrier semantic. By moving rcu_assign_pointer() after ctx->sk_proto is initialized, we can ensure that ctx->sk_proto are visible when changing sk->sk_prot. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/d72e126e9a36d3d33889829df8fc90100bb0e071 - https://git.kernel.org/stable/
References: - https://git.kernel.org/stable/c/d72e126e9a36d3d33889829df8fc90100bb0e071 - https://git.kernel.org/stable/c/2c260a24cf1c4d30ea3646124f766ee46169280b - https://git.kernel.org/stable/c/335c8f1566d8e44c384d16b450a18554896d4e8b - https://git.kernel.org/stable/c/ab67c2fd3d070a21914d0c31319d3858ab4e199c - https://git.kernel.org/stable/c/ef21007a7b581c7fe64d5a10c320880a033c837b - https://git.kernel.org/stable/c/91e61dd7a0af660408e87372d8330ceb218be302
CVE ID: CVE-2024-36491 State: PUBLISHED Published: 2024-07-17T08:50:11.777Z Last Updated: 2025-04-08T20:43:36.698Z Vendors: Century Systems Co., Ltd. Products: FutureNet NXR-1300 series, FutureNet NXR-650, FutureNet NXR-610X series, FutureNet NXR-530, FutureNet NXR-350/C, FutureNet NXR-230/C, FutureNet NXR-160/LW, FutureNet NXR-G200 series, FutureNet NXR-G180/L-CA, FutureNet NXR-G120 series, FutureNet NXR-G110 series, FutureNet NXR-G100 series, FutureNet NXR-G060 series, FutureNet NXR-G050 series, FutureNet VXR/x64, FutureNet VXR/x86, FutureNet NXR-1200, FutureNet NXR-130/C, FutureNet NXR-155/C series, FutureNet NXR-125/CX, FutureNet NXR-120/C, FutureNet WXR-250 Problem Types: OS command inj
, FutureNet NXR-155/C series, FutureNet NXR-125/CX, FutureNet NXR-120/C, FutureNet WXR-250 Problem Types: OS command injection Description: FutureNet NXR series, VXR series and WXR series provided by Century Systems Co., Ltd. allow an administrative user to execute an arbitrary OS command, obtain and/or alter sensitive information, and cause a denial-of-service (DoS) condition. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.centurysys.co.jp/backnumber/nxr_common/20240716-01.html - https://www.centurysys.co.jp/backnumber/nxr_common/20240716-03.html - https://jvn.jp/en/vu/JVNVU96424864/
CVE ID: CVE-2024-36492 State: PUBLISHED Published: 2024-08-01T14:05:01.393Z Last Updated: 2024-08-05T16:57:11.289Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L) Vendors: Mattermost Products: Mattermost Problem Types: CWE-284 Description: Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5, 9.8.x <= 9.8.1 fail to disallow the modification of local users when syncing users in shared channels. which allows a malicious remote to overwrite an existing local user. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2024-36493 State: PUBLISHED Published: 2025-01-14T14:21:21.051Z Last Updated: 2025-01-14T16:03:50.526Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Wavlink Products: Wavlink AC3000 Problem Types: CWE-121 Description: A stack-based buffer overflow vulnerability exists in the wireless.cgi set_wifi_basic() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_re
st Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2024-2041
CVE ID: CVE-2024-36494 State: PUBLISHED Published: 2024-12-12T12:51:14.761Z Last Updated: 2025-11-03T21:55:19.162Z Vendors: Image Access GmbH Products: Scan2Net Problem Types: CWE-79 Description: Due to missing input sanitization, an attacker can perform cross-site-scripting attacks and run arbitrary Javascript in the browser of other users. The login page at /cgi/slogin.cgi suffers from XSS due to improper input filtering of the -tsetup+-uuser parameter, which can only be exploited if the target user is not already logged in. This makes it ideal for login form phishing attempts. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://r.sec-consult.c
empts. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://r.sec-consult.com/imageaccess - https://www.imageaccess.de/?page=SupportPortal&lang=en
CVE ID: CVE-2024-36495 State: PUBLISHED Published: 2024-06-24T08:50:07.161Z Last Updated: 2025-02-13T17:52:54.797Z Vendors: Faronics Products: WINSelect (Standard + Enterprise) Problem Types: CWE-276 Description: The application Faronics WINSelect (Standard + Enterprise) saves its configuration in an encrypted file on the file system which "Everyone" has read and write access to, path to file: C:\ProgramData\WINSelect\WINSelect.wsd The path for the affected WINSelect Enterprise configuration file is: C:\ProgramData\Faronics\StorageSpace\WS\WINSelect.wsd Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://r.sec-consult.com/winselect - https://www.
otes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://r.sec-consult.com/winselect - https://www.faronics.com/en-uk/document-library/document/winselect-standard-release-notes - http://seclists.org/fulldisclosure/2024/Jun/12
CVE ID: CVE-2024-36496 State: PUBLISHED Published: 2024-06-24T09:04:18.257Z Last Updated: 2025-02-13T17:52:55.434Z Vendors: Faronics Products: WINSelect (Standard + Enterprise) Problem Types: CWE-798 Description: The configuration file is encrypted with a static key derived from a static five-character password which allows an attacker to decrypt this file. The application hashes this five-character password with the outdated and broken MD5 algorithm (no salt) and uses the first five bytes as the key for RC4. The configuration file is then encrypted with these parameters. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://r.sec-consult.com/winse
dditional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://r.sec-consult.com/winselect - https://www.faronics.com/en-uk/document-library/document/winselect-standard-release-notes - http://seclists.org/fulldisclosure/2024/Jun/12
CVE ID: CVE-2024-36497 State: PUBLISHED Published: 2024-06-24T09:06:03.500Z Last Updated: 2025-02-13T17:52:56.098Z Vendors: Faronics Products: WINSelect (Standard + Enterprise) Problem Types: CWE-312 Description: The decrypted configuration file contains the password in cleartext which is used to configure WINSelect. It can be used to remove the existing restrictions and disable WINSelect entirely. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://r.sec-consult.com/winselect - https://www.faronics.com/en-uk/document-library/document/winselect-standard-release-notes - http://seclists.org/fulldisclosure/2024/Jun/12
CVE ID: CVE-2024-36498 State: PUBLISHED Published: 2024-12-12T12:46:43.246Z Last Updated: 2025-11-03T21:55:20.669Z Vendors: Image Access GmbH Products: Scan2Net Problem Types: CWE-79 Description: Due to missing input sanitization, an attacker can perform cross-site-scripting attacks and run arbitrary Javascript in the browser of other users. The "Edit Disclaimer Text" function of the configuration menu is vulnerable to stored XSS. Only the users Poweruser and Admin can use this function which is available at the URL https://$SCANNER/cgi/admin.cgi?-rdisclaimer+-apre The stored Javascript payload will be executed every time the ScanWizard is loaded, even in the Kiosk-mode browser. Version 7.40
ed Javascript payload will be executed every time the ScanWizard is loaded, even in the Kiosk-mode browser. Version 7.40 implemented a fix, but it could be bypassed via URL-encoding the Javascript payload again. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://r.sec-consult.com/imageaccess - https://www.imageaccess.de/?page=SupportPortal&lang=en
CVE ID: CVE-2024-36499 State: PUBLISHED Published: 2024-06-14T07:17:27.308Z Last Updated: 2024-08-02T03:37:05.214Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L) Vendors: Huawei Products: HarmonyOS, EMUI Problem Types: CWE-269 Description: Vulnerability of unauthorized screenshot capturing in the WMS module Impact: Successful exploitation of this vulnerability may affect service confidentiality. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://consumer.huawei.com/en/support/bulletin/2024/6/
CVE ID: CVE-2024-36500 State: PUBLISHED Published: 2024-06-14T07:19:31.788Z Last Updated: 2024-08-02T03:37:05.311Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Huawei Products: HarmonyOS, EMUI Problem Types: CWE-269 Description: Privilege escalation vulnerability in the AMS module Impact: Successful exploitation of this vulnerability may affect service confidentiality. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://consumer.huawei.com/en/support/bulletin/2024/6/
CVE ID: CVE-2024-36501 State: PUBLISHED Published: 2024-06-14T07:21:34.942Z Last Updated: 2024-08-02T03:37:05.170Z Severity: MEDIUM (CVSS 5.6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:H) Vendors: Huawei Products: HarmonyOS, EMUI Problem Types: CWE-787 Description: Memory management vulnerability in the boottime module Impact: Successful exploitation of this vulnerability can affect integrity. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://consumer.huawei.com/en/support/bulletin/2024/6/