Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-11445 State: PUBLISHED Published: 2020-04-01T03:57:55 Last Updated: 2024-08-04T11:28:13.879Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AC:L/AV:N/A:N/C:L/I:N/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: TP-Link cloud cameras through 2020-02-09 allow remote attackers to bypass authentication and obtain sensitive information via vectors involving a Wi-Fi session with GPS enabled, aka CNVD-2020-04855. Additional Analyst Notes: - CVE Program Container: References: - https://www.cnvd.org.cn/flaw/show/1916613
CVE ID: CVE-2020-11446 State: PUBLISHED Published: 2020-04-29T13:15:49 Last Updated: 2024-08-04T11:28:14.011Z Vendors: n/a Products: n/a Problem Types: n/a Description: ESET Antivirus and Antispyware Module module 1553 through 1560 allows a user with limited access rights to create hard links in some ESET directories and then force the product to write through these links into files that would normally not be write-able by the user, thus achieving privilege escalation. Additional Analyst Notes: - CVE Program Container: References: - https://support.eset.com/en/ca7489-local-privilege-escalation-vulnerability-fixed-in-eset-products-for-windows
CVE ID: CVE-2020-11447 State: PUBLISHED Published: 2023-11-17T00:00:00 Last Updated: 2024-09-04T20:15:00.565Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Bell HomeHub 3000 SG48222070 devices. Remote authenticated users can retrieve the serial number via cgi/json-req - this is an information leak because the serial number is intended to prove an actor's physical access to the device. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.bell.ca/Internet/Connection-help/Access_control_in_the_Home_Hub_modems - https://0xem.ma/posts/HH3K-CVE/
CVE ID: CVE-2020-11448 State: PUBLISHED Published: 2023-11-17T00:00:00 Last Updated: 2024-09-04T20:04:48.676Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Bell HomeHub 3000 SG48222070 devices. There is XSS related to the email field and the login page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.bell.ca/Internet/Connection-help/Access_control_in_the_Home_Hub_modems - https://0xem.ma/posts/HH3K-CVE/
CVE ID: CVE-2020-11449 State: PUBLISHED Published: 2020-04-01T14:17:17 Last Updated: 2024-08-04T11:28:13.854Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Technicolor TC7337 8.89.17 devices. An attacker can discover admin credentials in the backup file, aka backupsettings.conf. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/RioIsDown/TC7337
CVE ID: CVE-2020-11450 State: PUBLISHED Published: 2020-04-02T15:01:45 Last Updated: 2024-08-04T11:28:13.908Z Vendors: n/a Products: n/a Problem Types: n/a Description: Microstrategy Web 10.4 exposes the JVM configuration, CPU architecture, installation folder, and other information through the URL /MicroStrategyWS/happyaxis.jsp. An attacker could use this vulnerability to learn more about the environment the application is running in. This issue has been mitigated in all versions of the product 11.0 and higher. Additional Analyst Notes: - CVE Program Container: References: - https://community.microstrategy.com/s/article/Web-Services-Security-Vulnerability - https://www.redtimmy.com/web-appl
- https://community.microstrategy.com/s/article/Web-Services-Security-Vulnerability - https://www.redtimmy.com/web-application-hacking/another-ssrf-another-rce-the-microstrategy-case/ - http://packetstormsecurity.com/files/157068/MicroStrategy-Intelligence-Server-And-Web-10.4-XSS-Disclosure-SSRF-Code-Execution.html - http://seclists.org/fulldisclosure/2020/Apr/1
CVE ID: CVE-2020-11451 State: PUBLISHED Published: 2020-04-02T15:00:28 Last Updated: 2024-08-04T11:28:14.093Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Upload Visualization plugin in the Microstrategy Web 10.4 admin panel allows an administrator to upload a ZIP archive containing files with arbitrary extensions and data. (This is also exploitable via SSRF). Note: The ability to upload visualization plugins requires administrator privileges. Additional Analyst Notes: - CVE Program Container: References: - https://community.microstrategy.com/s/article/Web-Services-Security-Vulnerability - https://www.redtimmy.com/web-application-hacking/another-ssrf-another-rce-the-microst
-Services-Security-Vulnerability - https://www.redtimmy.com/web-application-hacking/another-ssrf-another-rce-the-microstrategy-case/ - http://packetstormsecurity.com/files/157068/MicroStrategy-Intelligence-Server-And-Web-10.4-XSS-Disclosure-SSRF-Code-Execution.html - http://seclists.org/fulldisclosure/2020/Apr/1
CVE ID: CVE-2020-11452 State: PUBLISHED Published: 2020-04-02T15:02:46 Last Updated: 2024-08-04T11:28:13.963Z Vendors: n/a Products: n/a Problem Types: n/a Description: Microstrategy Web 10.4 includes functionality to allow users to import files or data from external resources such as URLs or databases. By providing an external URL under attacker control, it's possible to send requests to external resources (aka SSRF) or leak files from the local system using the file:// stream wrapper. Additional Analyst Notes: - CVE Program Container: References: - https://community.microstrategy.com/s/article/Web-Services-Security-Vulnerability - https://www.redtimmy.com/web-application-hacking/another-ss
strategy.com/s/article/Web-Services-Security-Vulnerability - https://www.redtimmy.com/web-application-hacking/another-ssrf-another-rce-the-microstrategy-case/ - http://packetstormsecurity.com/files/157068/MicroStrategy-Intelligence-Server-And-Web-10.4-XSS-Disclosure-SSRF-Code-Execution.html - http://seclists.org/fulldisclosure/2020/Apr/1
CVE ID: CVE-2020-11453 State: PUBLISHED Published: 2020-04-02T15:03:27 Last Updated: 2024-08-04T11:28:14.025Z Vendors: n/a Products: n/a Problem Types: n/a Description: Microstrategy Web 10.4 is vulnerable to Server-Side Request Forgery in the Test Web Service functionality exposed through the path /MicroStrategyWS/. The functionality requires no authentication and, while it is not possible to pass parameters in the SSRF request, it is still possible to exploit it to conduct port scanning. An attacker could exploit this vulnerability to enumerate the resources allocated in the network (IP addresses and services exposed). NOTE: MicroStrategy is unable to reproduce the issue reported in any ve
the network (IP addresses and services exposed). NOTE: MicroStrategy is unable to reproduce the issue reported in any version of its product Additional Analyst Notes: - CVE Program Container: References: - https://community.microstrategy.com/s/article/Web-Services-Security-Vulnerability - https://www.redtimmy.com/web-application-hacking/another-ssrf-another-rce-the-microstrategy-case/ - http://packetstormsecurity.com/files/157068/MicroStrategy-Intelligence-Server-And-Web-10.4-XSS-Disclosure-SSRF-Code-Execution.html - http://seclists.org/fulldisclosure/2020/Apr/1
CVE ID: CVE-2020-11454 State: PUBLISHED Published: 2020-04-02T14:58:59 Last Updated: 2024-08-04T11:28:14.055Z Vendors: n/a Products: n/a Problem Types: n/a Description: Microstrategy Web 10.4 is vulnerable to Stored XSS in the HTML Container and Insert Text features in the window, allowing for the creation of a new dashboard. In order to exploit this vulnerability, a user needs to get access to a shared dashboard or have the ability to create a dashboard on the application. Additional Analyst Notes: - CVE Program Container: References: - https://community.microstrategy.com/s/article/Web-Services-Security-Vulnerability - https://www.redtimmy.com/web-application-hacking/another-ssrf-another-rc
s/article/Web-Services-Security-Vulnerability - https://www.redtimmy.com/web-application-hacking/another-ssrf-another-rce-the-microstrategy-case/ - http://packetstormsecurity.com/files/157068/MicroStrategy-Intelligence-Server-And-Web-10.4-XSS-Disclosure-SSRF-Code-Execution.html - http://seclists.org/fulldisclosure/2020/Apr/1
CVE ID: CVE-2020-11455 State: PUBLISHED Published: 2020-04-01T15:48:18 Last Updated: 2024-08-04T11:28:13.992Z Vendors: n/a Products: n/a Problem Types: n/a Description: LimeSurvey before 4.1.12+200324 contains a path traversal vulnerability in application/controllers/admin/LimeSurveyFileManager.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/LimeSurvey/LimeSurvey/commit/daf50ebb16574badfb7ae0b8526ddc5871378f1b - http://packetstormsecurity.com/files/157112/LimeSurvey-4.1.11-Path-Traversal.html - https://www.exploit-db.com/exploits/48297
CVE ID: CVE-2020-11456 State: PUBLISHED Published: 2020-04-01T15:48:08 Last Updated: 2024-08-04T11:28:13.835Z Vendors: n/a Products: n/a Problem Types: n/a Description: LimeSurvey before 4.1.12+200324 has stored XSS in application/views/admin/surveysgroups/surveySettings.php and application/models/SurveysGroups.php (aka survey groups). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/LimeSurvey/LimeSurvey/commit/04b118acce2a74306f365ef329cbe00efc399b26 - http://packetstormsecurity.com/files/157114/LimeSurvey-4.1.11-Cross-Site-Scripting.html - https://www.exploit-db.com/exploits/48289
CVE ID: CVE-2020-11457 State: PUBLISHED Published: 2020-04-01T15:47:58 Last Updated: 2024-08-04T11:28:14.125Z Vendors: n/a Products: n/a Problem Types: n/a Description: pfSense before 2.4.5 has stored XSS in system_usermanager_addprivs.php in the WebGUI via the descr parameter (aka full name) of a user. Additional Analyst Notes: - CVE Program Container: References: - https://www.netgate.com/assets/downloads/advisories/pfSense-SA-20_06.webgui.asc - https://github.com/pfsense/pfsense/commit/3c1e53dabe966f27c9097a5a923e77f49ae5fffa - http://packetstormsecurity.com/files/157104/pfSense-2.4.4-P3-User-Manager-Cross-Site-Scripting.html - https://www.exploit-db.com/exploits/48300
CVE ID: CVE-2020-11458 State: PUBLISHED Published: 2020-04-02T11:32:48 Last Updated: 2024-08-04T11:28:13.985Z Vendors: n/a Products: n/a Problem Types: n/a Description: app/Model/feed.php in MISP before 2.4.124 allows administrators to choose arbitrary files that should be ingested by MISP. This does not cause a leak of the full contents of a file, but does cause a leaks of strings that match certain patterns. Among the data that can leak are passwords from database.php or GPG key passphrases from config.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/MISP/MISP/commit/30ff4b6451549dae7b526d4fb3a49061311ed477 - https://matthias.sdfeu.org/misp-poc.py
CVE ID: CVE-2020-11462 State: PUBLISHED Published: 2020-05-04T13:45:41 Last Updated: 2024-08-04T11:28:14.015Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in OpenVPN Access Server before 2.7.0 and 2.8.x before 2.8.3. With the full featured RPC2 interface enabled, it is possible to achieve a temporary DoS state of the management interface when sending an XML Entity Expansion (XEE) payload to the XMLRPC based RPC2 interface. The duration of the DoS state depends on available memory and CPU speed. The default restricted mode of the RPC2 interface is NOT vulnerable. Additional Analyst Notes: - CVE Program Container: References: - https://openvpn.net/vpn-serv
terface is NOT vulnerable. Additional Analyst Notes: - CVE Program Container: References: - https://openvpn.net/vpn-server-resources/release-notes/#Release_notes_for_OpenVPN_Access_Server_283
CVE ID: CVE-2020-11463 State: PUBLISHED Published: 2020-04-01T20:52:02 Last Updated: 2024-08-04T11:28:14.052Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Deskpro before 2019.8.0. The /api/email_accounts endpoint failed to properly validate a user's privilege, allowing an attacker to retrieve cleartext credentials of all helpdesk email accounts, including incoming and outgoing email credentials. This enables an attacker to get full access to all emails sent or received by the system including password reset emails, making it possible to reset any user's password. Additional Analyst Notes: - CVE Program Container: References: - https://blog.redforce.io
to reset any user's password. Additional Analyst Notes: - CVE Program Container: References: - https://blog.redforce.io/attacking-helpdesks-part-1-rce-chain-on-deskpro/ - https://support.deskpro.com/en/news/posts/deskpro-v2019-8-0-released-security-update - https://support.deskpro.com/en/news/posts/deskpro-security-update-2019-09
CVE ID: CVE-2020-11464 State: PUBLISHED Published: 2020-04-01T20:51:54 Last Updated: 2024-08-04T11:28:14.063Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AC:L/AV:N/A:N/C:H/I:N/PR:L/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Deskpro before 2019.8.0. The /api/people endpoint failed to properly validate a user's privilege, allowing an attacker to retrieve sensitive information about all users registered on the system. This includes their full name, privilege, email address, phone number, etc. Additional Analyst Notes: - CVE Program Container: References: - https://blog.redforce.io/attacking-helpdesks-part-1-rce-chain-on-deskpro/ - https://support.des
Container: References: - https://blog.redforce.io/attacking-helpdesks-part-1-rce-chain-on-deskpro/ - https://support.deskpro.com/en/news/posts/deskpro-v2019-8-0-released-security-update - https://support.deskpro.com/en/news/posts/deskpro-security-update-2019-09
CVE ID: CVE-2020-11465 State: PUBLISHED Published: 2020-04-01T20:51:46 Last Updated: 2024-08-04T11:28:14.038Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AC:L/AV:N/A:H/C:H/I:H/PR:L/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Deskpro before 2019.8.0. The /api/apps/* endpoints failed to properly validate a user's privilege, allowing an attacker to control/install helpdesk applications and leak current applications' configurations, including applications used as user sources (used for authentication). This enables an attacker to forge valid authentication models that resembles any user on the system. Additional Analyst Notes: - CVE Program Container: Re
valid authentication models that resembles any user on the system. Additional Analyst Notes: - CVE Program Container: References: - https://blog.redforce.io/attacking-helpdesks-part-1-rce-chain-on-deskpro/ - https://support.deskpro.com/en/news/posts/deskpro-v2019-8-0-released-security-update - https://support.deskpro.com/en/news/posts/deskpro-security-update-2019-09
CVE ID: CVE-2020-11466 State: PUBLISHED Published: 2020-04-01T20:51:37 Last Updated: 2024-08-04T11:28:14.189Z Severity: HIGH (CVSS 7.6 CVSS:3.0/AC:L/AV:N/A:L/C:H/I:L/PR:L/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Deskpro before 2019.8.0. The /api/tickets endpoint failed to properly validate a user's privilege, allowing an attacker to retrieve arbitrary information about all helpdesk tickets stored in database with numerous filters. This leaked sensitive information to unauthorized parties. Additionally, it leaked ticket authentication code, making it possible to make changes to a ticket. Additional Analyst Notes: - CVE Program Container:
authentication code, making it possible to make changes to a ticket. Additional Analyst Notes: - CVE Program Container: References: - https://blog.redforce.io/attacking-helpdesks-part-1-rce-chain-on-deskpro/ - https://support.deskpro.com/en/news/posts/deskpro-v2019-8-0-released-security-update - https://support.deskpro.com/en/news/posts/deskpro-security-update-2019-09
CVE ID: CVE-2020-11467 State: PUBLISHED Published: 2020-04-01T20:51:22 Last Updated: 2024-08-04T11:28:14.081Z Severity: CRITICAL (CVSS 9.1 CVSS:3.0/AC:L/AV:N/A:H/C:H/I:H/PR:H/S:C/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Deskpro before 2019.8.0. This product enables administrators to modify the helpdesk interface by editing /portal/api/style/edit-theme-set/template-sources theme templates, and uses TWIG as its template engine. While direct access to self and _self variables was not permitted, one could abuse the accessible variables in one's context to reach a native unserialize function via the code parameter. There, on could pass a crafted
ariables in one's context to reach a native unserialize function via the code parameter. There, on could pass a crafted payload to trigger a set of POP gadgets in order to achieve remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://blog.redforce.io/attacking-helpdesks-part-1-rce-chain-on-deskpro/ - https://support.deskpro.com/en/news/posts/deskpro-v2019-8-0-released-security-update - https://support.deskpro.com/en/news/posts/deskpro-security-update-2019-09
CVE ID: CVE-2020-11469 State: PUBLISHED Published: 2020-04-01T22:01:28 Last Updated: 2024-08-04T11:28:14.143Z Severity: MEDIUM (CVSS 6.3 CVSS:3.0/AC:H/AV:L/A:H/C:H/I:H/PR:H/S:U/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: Zoom Client for Meetings through 4.6.8 on macOS copies runwithroot to a user-writable temporary directory during installation, which allows a local process (with the user's privileges) to obtain root access by replacing runwithroot. Additional Analyst Notes: - CVE Program Container: References: - https://objective-see.com/blog/blog_0x56.html - https://blog.zoom.us/wordpress/2020/04/01/a-message-to-our-users/
CVE ID: CVE-2020-11470 State: PUBLISHED Published: 2020-04-01T22:00:51 Last Updated: 2024-08-04T11:28:14.024Z Severity: LOW (CVSS 2.3 CVSS:3.0/AC:H/AV:L/A:N/C:L/I:N/PR:H/S:C/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: Zoom Client for Meetings through 4.6.8 on macOS has the disable-library-validation entitlement, which allows a local process (with the user's privileges) to obtain unprompted microphone and camera access by loading a crafted library and thereby inheriting Zoom Client's microphone and camera access. Additional Analyst Notes: - CVE Program Container: References: - https://objective-see.com/blog/blog_0x56.html - https://blog.zoom.us/wordpress/2020/04/01/a-mess
ontainer: References: - https://objective-see.com/blog/blog_0x56.html - https://blog.zoom.us/wordpress/2020/04/01/a-message-to-our-users/
CVE ID: CVE-2020-11474 State: PUBLISHED Published: 2020-07-28T20:34:03 Last Updated: 2024-08-04T11:28:14.052Z Vendors: n/a Products: n/a Problem Types: n/a Description: NCP Secure Enterprise Client before 10.15 r47589 allows a symbolic link attack on enumusb.reg via Support Assistant. Additional Analyst Notes: - CVE Program Container: References: - https://herolab.usd.de/security-advisories/ - https://herolab.usd.de/security-advisories/usd-2020-0038/
CVE ID: CVE-2020-11476 State: PUBLISHED Published: 2020-07-28T20:31:14 Last Updated: 2024-08-04T11:28:14.032Z Vendors: n/a Products: n/a Problem Types: n/a Description: Concrete5 before 8.5.3 allows Unrestricted Upload of File with Dangerous Type such as a .phar file. Additional Analyst Notes: - CVE Program Container: References: - https://herolab.usd.de/security-advisories/ - https://herolab.usd.de/security-advisories/usd-2020-0041/ - https://github.com/concrete5/concrete5/pull/8713 - https://github.com/concrete5/concrete5/releases/tag/8.5.3
CVE ID: CVE-2020-11483 State: PUBLISHED Published: 2020-10-29T03:35:30 Last Updated: 2024-08-04T11:28:14.182Z Vendors: NVIDIA Products: NVIDIA DGX Servers Problem Types: escalation of privileges and information disclosure Description: NVIDIA DGX servers, all DGX-1 with BMC firmware versions prior to 3.38.30 and all DGX-2 with BMC firmware versions prior to 1.06.06, contains a vulnerability in the AMI BMC firmware in which the firmware includes hard-coded credentials, which may lead to elevation of privileges or information disclosure. Additional Analyst Notes: - CVE Program Container: References: - https://nvidia.custhelp.com/app/answers/detail/a_id/5010
CVE ID: CVE-2020-11484 State: PUBLISHED Published: 2020-10-29T03:35:30 Last Updated: 2024-08-04T11:28:13.894Z Vendors: NVIDIA Products: NVIDIA DGX Servers Problem Types: information disclosure Description: NVIDIA DGX servers, all DGX-1 with BMC firmware versions prior to 3.38.30, contains a vulnerability in the AMI BMC firmware in which an attacker with administrative privileges can obtain the hash of the BMC/IPMI user password, which may lead to information disclosure. Additional Analyst Notes: - CVE Program Container: References: - https://nvidia.custhelp.com/app/answers/detail/a_id/5010
CVE ID: CVE-2020-11485 State: PUBLISHED Published: 2020-10-29T03:35:30 Last Updated: 2024-08-04T11:35:12.421Z Vendors: NVIDIA Products: NVIDIA DGX Servers Problem Types: information disclosure or code execution Description: NVIDIA DGX servers, all DGX-1 with BMC firmware versions prior to 3.38.30, contains a Cross-Site Request Forgery (CSRF) vulnerability in the AMI BMC firmware in which the web application does not sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request, which can lead to information disclosure or code execution. Additional Analyst Notes: - CVE Program Container: References: - https://nvidia.custh
tion disclosure or code execution. Additional Analyst Notes: - CVE Program Container: References: - https://nvidia.custhelp.com/app/answers/detail/a_id/5010
CVE ID: CVE-2020-11486 State: PUBLISHED Published: 2020-10-29T03:35:31 Last Updated: 2024-08-04T11:35:12.026Z Vendors: NVIDIA Products: NVIDIA DGX Servers Problem Types: remote code execution Description: NVIDIA DGX servers, all DGX-1 with BMC firmware versions prior to 3.38.30, contain a vulnerability in the AMI BMC firmware in which software allows an attacker to upload or transfer files that can be automatically processed within the product's environment, which may lead to remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://nvidia.custhelp.com/app/answers/detail/a_id/5010
CVE ID: CVE-2020-11487 State: PUBLISHED Published: 2020-10-29T03:35:31 Last Updated: 2024-08-04T11:35:11.981Z Vendors: NVIDIA Products: NVIDIA DGX Servers Problem Types: information disclosure Description: NVIDIA DGX servers, DGX-1 with BMC firmware versions prior to 3.38.30. DGX-2 with BMC firmware versions prior to 1.06.06 and all DGX A100 Servers with all BMC firmware versions, contains a vulnerability in the AMI BMC firmware in which the use of a hard-coded RSA 1024 key with weak ciphers may lead to information disclosure. Additional Analyst Notes: - CVE Program Container: References: - https://nvidia.custhelp.com/app/answers/detail/a_id/5010
CVE ID: CVE-2020-11488 State: PUBLISHED Published: 2020-10-29T03:35:32 Last Updated: 2024-08-04T11:35:12.447Z Vendors: NVIDIA Products: NVIDIA DGX Servers Problem Types: code execution or information disclosure Description: NVIDIA DGX servers, all DGX-1 with BMC firmware versions prior to 3.38.30 and all DGX-2 with BMC firmware versions prior to 1.06.06, contains a vulnerability in the AMI BMC firmware in which software does not validate the RSA 1024 public key used to verify the firmware signature, which may lead to information disclosure or code execution. Additional Analyst Notes: - CVE Program Container: References: - https://nvidia.custhelp.com/app/answers/detail/a_id/5010
CVE ID: CVE-2020-11489 State: PUBLISHED Published: 2020-10-29T03:35:32 Last Updated: 2024-08-04T11:35:12.442Z Vendors: NVIDIA Products: NVIDIA DGX Servers Problem Types: information disclosure Description: NVIDIA DGX servers, all DGX-1 with BMC firmware versions prior to 3.38.30 and all DGX-2 with BMC firmware versions prior to 1.06.06, contain a vulnerability in the AMI BMC firmware in which default SNMP community strings are used, which may lead to information disclosure. Additional Analyst Notes: - CVE Program Container: References: - https://nvidia.custhelp.com/app/answers/detail/a_id/5010