Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-37002 State: PUBLISHED Published: 2024-06-25T03:07:28.673Z Last Updated: 2025-08-27T21:14:27.526Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Autodesk Products: AutoCAD, AutoCAD Architecture, AutoCAD Electrical, AutoCAD Mechanical, AutoCAD MEP, AutoCAD Plant 3D, Civil 3D, Advance Steel, AutoCAD MAP 3D Problem Types: CWE-457 Description: A maliciously crafted MODEL file, when parsed in ASMkern229A.dllthrough Autodesk applications, can be used to uninitialized variables. This vulnerability, along with other vulnerabilities, could lead to code execution in the current process. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program C
could lead to code execution in the current process. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0009
CVE ID: CVE-2024-37003 State: PUBLISHED Published: 2024-06-25T03:12:13.660Z Last Updated: 2025-08-27T21:14:17.508Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Autodesk Products: AutoCAD, AutoCAD Architecture, AutoCAD Electrical, AutoCAD Mechanical, AutoCAD MEP, AutoCAD Plant 3D, Civil 3D, Advance Steel, AutoCAD MAP 3D Problem Types: CWE-121 Description: A maliciously crafted DWG and SLDPRT file, when parsed in opennurbs.dll and ODXSW_DLL.dll through Autodesk applications, can be used to cause a Stack-based Overflow. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the curre
leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0009
CVE ID: CVE-2024-37004 State: PUBLISHED Published: 2024-06-25T03:13:05.174Z Last Updated: 2025-08-27T21:14:02.838Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Autodesk Products: AutoCAD, AutoCAD Architecture, AutoCAD Electrical, AutoCAD Mechanical, AutoCAD MEP, AutoCAD Plant 3D, Civil 3D, Advance Steel, AutoCAD MAP 3D Problem Types: CWE-416 Description: A maliciously crafted SLDPRT file, when parsed in ASMKERN229A.dll through Autodesk applications, can cause a use-after-free vulnerability. This vulnerability, along with other vulnerabilities, could lead to code execution in the current process. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Progr
ies, could lead to code execution in the current process. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0009
CVE ID: CVE-2024-37005 State: PUBLISHED Published: 2024-06-25T03:13:51.990Z Last Updated: 2025-08-27T21:13:49.343Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Autodesk Products: AutoCAD, AutoCAD Architecture, AutoCAD Electrical, AutoCAD Mechanical, AutoCAD MEP, AutoCAD Plant 3D, Civil 3D, Advance Steel, AutoCAD MAP 3D Problem Types: CWE-125 Description: A maliciously crafted X_B file, when parsed in pskernel.DLL through Autodesk applications, can force an Out-of-Bound Read. A malicious actor can leverage this vulnerability to cause a crash,read sensitive data, or execute arbitrary code in the context of the current process. Additional Analyst Notes: - CISA
h,read sensitive data, or execute arbitrary code in the context of the current process. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0009
CVE ID: CVE-2024-37006 State: PUBLISHED Published: 2024-06-25T03:15:46.957Z Last Updated: 2025-08-27T21:13:36.557Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Autodesk Products: AutoCAD, AutoCAD Architecture, AutoCAD Electrical, AutoCAD Mechanical, AutoCAD MEP, AutoCAD Plant 3D, Civil 3D, Advance Steel, AutoCAD MAP 3D Problem Types: CWE-119 Description: A maliciously crafted CATPRODUCT file, when parsed in CC5Dll.dll through Autodesk applications, can lead to a memory corruption vulnerability by write access violation. This vulnerability, in conjunction with other vulnerabilities, can lead to code execution in the context of the current process. Additional
CVE ID: CVE-2024-37007 State: PUBLISHED Published: 2024-06-25T03:35:23.524Z Last Updated: 2025-08-27T21:13:22.152Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Autodesk Products: AutoCAD, AutoCAD Architecture, AutoCAD Electrical, AutoCAD Mechanical, AutoCAD MEP, AutoCAD Plant 3D, Civil 3D, Advance Steel, AutoCAD MAP 3D Problem Types: CWE-416 Description: A maliciously crafted X_B and X_T file, when parsed in pskernel.DLL through Autodesk applications, can cause a use-after-free vulnerability. This vulnerability, along with other vulnerabilities, could lead to code execution in the current process. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Pro
ities, could lead to code execution in the current process. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0010
CVE ID: CVE-2024-37008 State: PUBLISHED Published: 2024-08-21T10:02:21.128Z Last Updated: 2025-08-26T18:07:00.526Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Autodesk Products: Revit, Revit LT Problem Types: CWE-121 Description: A maliciously crafted DWG file, when parsed in Revit, can force a stack-based buffer overflow. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0013
CVE ID: CVE-2024-37014 State: PUBLISHED Published: 2024-06-10T00:00:00 Last Updated: 2024-08-02T03:43:50.609Z Vendors: n/a Products: n/a Problem Types: n/a Description: Langflow through 0.6.19 allows remote code execution if untrusted users are able to reach the "POST /api/v1/custom_component" endpoint and provide a Python script. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/langflow-ai/langflow/issues/1973
CVE ID: CVE-2024-37015 State: PUBLISHED Published: 2024-08-13T00:00:00 Last Updated: 2024-08-13T18:25:46.690Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Ada Web Server 20.0. When configured to use SSL (which is not the default setting), the SSL/TLS used to establish connections to external services is done without proper hostname validation. This is exploitable by man-in-the-middle attackers. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/AdaCore/aws - https://docs.adacore.com/corp/security-advisories/SEC.AWS-0031-v2.pdf
CVE ID: CVE-2024-37016 State: PUBLISHED Published: 2024-07-15T00:00:00 Last Updated: 2024-08-02T03:43:50.796Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mengshen Wireless Door Alarm M70 2024-05-24 allows Authentication Bypass via a Capture-Replay approach. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.syss.de/pentest-blog/ - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-045.txt
CVE ID: CVE-2024-37017 State: PUBLISHED Published: 2024-05-30T23:40:22.806Z Last Updated: 2025-02-13T15:59:46.407Z Vendors: n/a Products: n/a Problem Types: n/a Description: asdcplib (aka AS-DCP Lib) 2.13.1 has a heap-based buffer over-read in ASDCP::TimedText::MXFReader::h__Reader::MD_to_TimedText_TDesc in AS_DCP_TimedText.cpp in libasdcp.so. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/cinecert/asdcplib/issues/138
CVE ID: CVE-2024-37018 State: PUBLISHED Published: 2024-05-31T00:35:10.757Z Last Updated: 2025-02-13T15:59:47.007Z Vendors: n/a Products: n/a Problem Types: n/a Description: The OpenDaylight 0.15.3 controller allows topology poisoning via API requests because an application can manipulate the path that is taken by discovery packets. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jira.opendaylight.org/browse/DISCOVERY-2 - https://mvnrepository.com/artifact/org.opendaylight.controller - https://dl.acm.org/doi/10.1145/3658644.3690345 - https://github.com/mzc796/marionette_onos - https://github.com/mzc796/marionette_odl
CVE ID: CVE-2024-37019 State: PUBLISHED Published: 2024-06-03T18:02:10.198Z Last Updated: 2025-02-13T15:59:47.489Z Vendors: n/a Products: n/a Problem Types: n/a Description: Northern.tech Mender Enterprise before 3.6.4 and 3.7.x before 3.7.4 has Weak Authentication. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://northern.tech - https://mender.io/blog/cve-2024-37019-account-takeover-using-saml
CVE ID: CVE-2024-37020 State: PUBLISHED Published: 2025-02-12T21:20:00.522Z Last Updated: 2025-11-03T20:37:58.276Z Severity: LOW (CVSS 3.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L) Vendors: n/a Products: Intel(R) Xeon(R) Processors Problem Types: Denial of Service, CWE-1281 Description: Sequence of processor instructions leads to unexpected behavior in the Intel(R) DSA V1.0 for some Intel(R) Xeon(R) Processors may allow an authenticated user to potentially enable denial of service via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01194.html
CVE ID: CVE-2024-37021 State: PUBLISHED Published: 2024-06-24T13:56:52.091Z Last Updated: 2025-11-03T20:37:59.688Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: fpga: manager: add owner module and take its refcount The current implementation of the fpga manager assumes that the low-level module registers a driver for the parent device and uses its owner pointer to take the module's refcount. This approach is problematic since it can lead to a null pointer dereference while attempting to get the manager if the parent device does not have a driver. To address this problem, add a module owner pointer to the fpga_manager struct an
parent device does not have a driver. To address this problem, add a module owner pointer to the fpga_manager struct and use it to take the module's refcount. Modify the functions for registering the manager to take an additional owner module parameter and rename them to avoid conflicts. Use the old function names for helper macros that automatically set the module that registers the manager as the owner. This ensures compatibility with existing low-level control modules and reduces the chances of registering a manager without setting the owner. Also, update the documentation to keep it consistent with the new interface for registering an fpga manager. Other changes: opportunistically move
ion to keep it consistent with the new interface for registering an fpga manager. Other changes: opportunistically move put_device() from __fpga_mgr_get() to fpga_mgr_get() and of_fpga_mgr_get() to improve code clarity since the manager device is taken in these functions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/304f8032d601d4f9322ca841cd0b573bd1beb158 - https://git.kernel.org/stable/c/2da62a139a6221a345db4eb9f4f1c4b0937c89ad - https://git.kernel.org/stable/c/62ac496a01c9337a11362cea427038ba621ca9eb - https://git.kernel.org/stable/c/4d4d2d4346857bf778fafaa97d6f76bb1663e3c9
CVE ID: CVE-2024-37022 State: PUBLISHED Published: 2024-06-13T17:25:49.609Z Last Updated: 2024-08-02T03:43:50.589Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Fuji Electric Products: Tellus Lite V-Simulator Problem Types: CWE-787 Description: Fuji Electric Tellus Lite V-Simulator is vulnerable to an out-of-bounds write, which could allow an attacker to manipulate memory, resulting in execution of arbitrary code. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-165-14
CVE ID: CVE-2024-37023 State: PUBLISHED Published: 2024-08-08T19:30:40.496Z Last Updated: 2024-08-21T20:04:21.492Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Vonets Products: VAR1200-H, VAR1200-L, VAR600-H, VAP11AC, VAP11G-500S, VBG1200, VAP11S-5G, VAP11S, VAR11N-300, VAP11G-300, VAP11N-300, VAP11G, VAP11G-500, VGA-1000 Problem Types: CWE-77 Description: Multiple OS command injection vulnerabilities affecting Vonets industrial wifi bridge relays and wifi bridge repeaters, software versions 3.3.23.6.9 and prior, enable an authenticated remote attacker to execute arbitrary OS commands via various endpoint parameters. Additional Analyst Notes: - CISA ADP
d remote attacker to execute arbitrary OS commands via various endpoint parameters. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-214-08
CVE ID: CVE-2024-37024 State: PUBLISHED Published: 2024-11-13T21:10:55.888Z Last Updated: 2024-11-14T19:41:27.199Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: ACAT software maintained by Intel(R) for Windows Problem Types: escalation of privilege, CWE-427 Description: Uncontrolled search path for some ACAT software maintained by Intel(R) for Windows before version 3.11.0 may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01176.html
CVE ID: CVE-2024-37025 State: PUBLISHED Published: 2024-11-13T21:11:55.168Z Last Updated: 2024-11-14T14:41:14.729Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) Advanced Link Analyzer Standard Edition software installer Problem Types: escalation of privilege, CWE-279 Description: Incorrect execution-assigned permissions in some Intel(R) Advanced Link Analyzer Standard Edition software installer before version 23.1.1 may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advi
ional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01197.html
CVE ID: CVE-2024-37026 State: PUBLISHED Published: 2024-06-24T13:56:52.759Z Last Updated: 2025-05-04T09:13:18.655Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/xe: Only use reserved BCS instances for usm migrate exec queue The GuC context scheduling queue is 2 entires deep, thus it is possible for a migration job to be stuck behind a fault if migration exec queue shares engines with user jobs. This can deadlock as the migrate exec queue is required to service page faults. Avoid deadlock by only using reserved BCS instances for usm migrate exec queue. (cherry picked from commit 04f4a70a183a688a60fe3882d6e4236ea02cfc67) Add
erved BCS instances for usm migrate exec queue. (cherry picked from commit 04f4a70a183a688a60fe3882d6e4236ea02cfc67) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/92deed4a9bfd9ef187764225bba530116c49e15c - https://git.kernel.org/stable/c/c8ea2c31f5ea437199b239d76ad5db27343edb0c
CVE ID: CVE-2024-37027 State: PUBLISHED Published: 2024-11-13T21:11:40.594Z Last Updated: 2024-11-14T19:39:15.316Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H) Vendors: n/a Products: Intel(R) VTune(TM) Profiler software Problem Types: denial of service, CWE-20 Description: Improper Input validation in some Intel(R) VTune(TM) Profiler software before version 2024.2.0 may allow an authenticated user to potentially enable denial of service via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01187.html
CVE ID: CVE-2024-37028 State: PUBLISHED Published: 2024-08-14T14:32:33.153Z Last Updated: 2024-08-16T17:26:57.485Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: F5 Products: BIG-IP Next Central Manager Problem Types: CWE-645 Description: BIG-IP Next Central Manager may allow an attacker to lock out an account that has never been logged in. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://my.f5.com/manage/s/article/K000139938
CVE ID: CVE-2024-37029 State: PUBLISHED Published: 2024-06-13T17:23:40.591Z Last Updated: 2024-08-02T03:43:50.796Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Fuji Electric Products: Tellus Lite V-Simulator Problem Types: CWE-121 Description: Fuji Electric Tellus Lite V-Simulator is vulnerable to a stack-based buffer overflow, which could allow an attacker to execute arbitrary code. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-165-14
CVE ID: CVE-2024-37030 State: PUBLISHED Published: 2024-07-02T08:13:36.884Z Last Updated: 2024-08-02T03:43:50.808Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L) Vendors: OpenHarmony Products: OpenHarmony Problem Types: CWE-416 Description: in OpenHarmony v4.0.0 and prior versions allow a remote attacker arbitrary code execution in pre-installed apps through use after free. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2024/2024-07.md
CVE ID: CVE-2024-37031 State: PUBLISHED Published: 2024-06-03T05:54:46.881Z Last Updated: 2025-02-13T15:59:48.084Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Active Admin (aka activeadmin) framework before 3.2.2 for Ruby on Rails allows stored XSS in certain situations where users can create entities (to be later edited in forms) with arbitrary names, aka a "dynamic form legends" issue. 4.0.0.beta7 is also a fixed version. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://rubygems.org/gems/activeadmin/versions/3.2.2 - https://github.com/activeadmin/activeadmin/releases/tag/v3.2.2 - https://github.com/activeadmin/activeadmin/
ons/3.2.2 - https://github.com/activeadmin/activeadmin/releases/tag/v3.2.2 - https://github.com/activeadmin/activeadmin/security/advisories/GHSA-9mg6-x45v-hcfm
CVE ID: CVE-2024-37032 State: PUBLISHED Published: 2024-05-31T00:00:00.000Z Last Updated: 2025-03-27T20:57:59.559Z Vendors: n/a Products: n/a Problem Types: n/a Description: Ollama before 0.1.34 does not validate the format of the digest (sha256 with 64 hex digits) when getting the model path, and thus mishandles the TestGetBlobsPath test cases such as fewer than 64 hex digits, more than 64 hex digits, or an initial ../ substring. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/ollama/ollama/pull/4175 - https://github.com/ollama/ollama/compare/v0.1.33...v0.1.34 - https://github.com/ollama/ollama/blob/adeb40eaf29039b8964425f69a9315f
thub.com/ollama/ollama/compare/v0.1.33...v0.1.34 - https://github.com/ollama/ollama/blob/adeb40eaf29039b8964425f69a9315f9f1694ba8/server/modelpath_test.go#L41-L58 - https://www.vicarius.io/vsociety/posts/probllama-in-ollama-a-tale-of-a-yet-another-rce-vulnerability-cve-2024-37032
CVE ID: CVE-2024-37034 State: PUBLISHED Published: 2024-07-26T00:00:00.000Z Last Updated: 2025-03-14T16:03:26.661Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Couchbase Server before 7.2.5 and 7.6.0 before 7.6.1. It does not ensure that credentials are negotiated with the Key-Value (KV) service using SCRAM-SHA when remote link encryption is configured for Half-Secure. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.couchbase.com/alerts/
CVE ID: CVE-2024-37036 State: PUBLISHED Published: 2024-06-12T16:48:09.163Z Last Updated: 2024-08-02T03:43:50.996Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Schneider Electric Products: Sage 1410, Sage 1430, Sage 1450, Sage 2400, Sage 3030 Magnum, Sage 4400 Problem Types: CWE-787 Description: CWE-787: Out-of-bounds Write vulnerability exists that could result in an authentication bypass when sending a malformed POST request and particular configuration parameters are set. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-163-05&p_enDocType=Securi
ram Container: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-163-05&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-163-05.pdf
CVE ID: CVE-2024-37037 State: PUBLISHED Published: 2024-06-12T16:50:09.159Z Last Updated: 2024-08-02T03:43:50.902Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) Vendors: Schneider Electric Products: Sage 1410, Sage 1430, Sage 1450, Sage 2400, Sage 3030 Magnum, Sage 4400 Problem Types: CWE-22 Description: CWE-22: Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) vulnerability exists that could allow an authenticated user with access to the device’s web interface to corrupt files and impact device functionality when sending a crafted HTTP request. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - http
g a crafted HTTP request. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-163-05&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-163-05.pdf
CVE ID: CVE-2024-37038 State: PUBLISHED Published: 2024-06-12T16:51:55.800Z Last Updated: 2024-08-02T03:43:50.738Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Schneider Electric Products: Sage 1410, Sage 1430, Sage 1450, Sage 2400, Sage 3030 Magnum, Sage 4400 Problem Types: CWE-276 Description: CWE-276: Incorrect Default Permissions vulnerability exists that could allow an authenticated user with access to the device’s web interface to perform unauthorized file and firmware uploads when crafting custom web requests. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://download.schneider-electric.com/files?p_Doc_
es: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-163-05&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-163-05.pdf
CVE ID: CVE-2024-37039 State: PUBLISHED Published: 2024-06-12T16:54:23.117Z Last Updated: 2024-08-02T03:43:50.886Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Schneider Electric Products: Sage 1410, Sage 1430, Sage 1450, Sage 2400, Sage 3030 Magnum, Sage 4400 Problem Types: CWE-252 Description: CWE-252: Unchecked Return Value vulnerability exists that could cause denial of service of the device when an attacker sends a specially crafted HTTP request. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-163-05&p_enDocType=Security+and+Safety+Notice&p_Fil
- https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-163-05&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-163-05.pdf