Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-33856 State: PUBLISHED Published: 2024-05-07T00:00:00 Last Updated: 2024-08-02T02:42:58.871Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Logpoint before 7.4.0. An attacker can enumerate a valid list of usernames by observing the response time at the Forgot Password endpoint. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://servicedesk.logpoint.com/hc/en-us/categories/200832975-Knowledge-Center - https://servicedesk.logpoint.com/hc/en-us/articles/18533583876253-Username-enumeration-using-the-forget-password-endpoint
CVE ID: CVE-2024-33857 State: PUBLISHED Published: 2024-05-07T00:00:00 Last Updated: 2024-08-02T02:42:59.670Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Logpoint before 7.4.0. Due to a lack of input validation on URLs in threat intelligence, an attacker with low-level access to the system can trigger Server Side Request Forgery. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://servicedesk.logpoint.com/hc/en-us/categories/200832975-Knowledge-Center - https://servicedesk.logpoint.com/hc/en-us/articles/18533639896093-Server-Side-Request-Forgery-SSRF-on-Threat-Intelligence
CVE ID: CVE-2024-33858 State: PUBLISHED Published: 2024-05-07T00:00:00 Last Updated: 2024-11-21T19:36:32.974Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Logpoint before 7.4.0. A path injection vulnerability is seen while adding a CSV enrichment source. The source_name parameter could be changed to an absolute path; this will write the CSV file to that path inside the /tmp directory. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.logpoint.com/ - https://servicedesk.logpoint.com/hc/en-us/articles/18533668045725-Path-Injection-on-Enrichment-Sources-leading-to-arbitrary-file-write-in-tmp-folder
CVE ID: CVE-2024-33859 State: PUBLISHED Published: 2024-05-07T00:00:00 Last Updated: 2024-11-19T21:43:36.260Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Logpoint before 7.4.0. HTML code sent through logs wasn't being escaped in the "Interesting Field" Web UI, leading to XSS. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.logpoint.com/ - https://servicedesk.logpoint.com/hc/en-us/articles/18533927651357-XSS-in-Interesting-Fields-in-Logpoint-Web-UI
CVE ID: CVE-2024-33860 State: PUBLISHED Published: 2024-05-07T00:00:00 Last Updated: 2024-08-02T02:42:58.643Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Logpoint before 7.4.0. It allows Local File Inclusion (LFI) when an arbitrary File Path is used within the File System Collector. The content of the file specified can be viewed in the incoming logs. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://logpoint.com - https://servicedesk.logpoint.com/hc/en-us/articles/18533986803741-Local-File-Inclusion-in-File-System-Collector
CVE ID: CVE-2024-33862 State: PUBLISHED Published: 2024-07-05T00:00:00 Last Updated: 2024-08-02T02:42:59.324Z Vendors: n/a Products: n/a Problem Types: n/a Description: A buffer-management vulnerability in OPC Foundation OPCFoundation.NetStandard.Opc.Ua.Core before 1.05.374.54 could allow remote attackers to exhaust memory resources. It is triggered when the system receives an excessive number of messages from a remote source. This could potentially lead to a denial of service (DoS) condition, disrupting the normal operation of the system. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://files.opcfoundation.org/SecurityBulletins/OPC%20Foundati
DP Vulnrichment: - CVE Program Container: References: - https://files.opcfoundation.org/SecurityBulletins/OPC%20Foundation%20Security%20Bulletin%20CVE-2024-33862.pdf
CVE ID: CVE-2024-33863 State: PUBLISHED Published: 2024-05-14T13:28:52.672Z Last Updated: 2025-02-13T15:52:54.137Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in linqi before 1.4.0.1 on Windows. There is /api/Cdn/GetFile local file inclusion. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.linqi.de/de-DE/blog.html - https://linqi.help/Updates/en#/SecurityUpdates
CVE ID: CVE-2024-33864 State: PUBLISHED Published: 2024-05-14T13:30:37.876Z Last Updated: 2025-02-13T15:52:54.669Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in linqi before 1.4.0.1 on Windows. There is SSRF via Document template generation; i.e., via remote images in process creation, file inclusion, and PDF document generation via malicious JavaScript. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.linqi.de/de-DE/blog.html - https://linqi.help/Updates/en#/SecurityUpdates
CVE ID: CVE-2024-33865 State: PUBLISHED Published: 2024-05-14T13:32:04.644Z Last Updated: 2025-02-13T15:52:55.176Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in linqi before 1.4.0.1 on Windows. There is an NTLM hash leak via the /api/Cdn/GetFile and /api/DocumentTemplate/{GUID] endpoints. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.linqi.de/de-DE/blog.html - https://linqi.help/Updates/en#/SecurityUpdates
CVE ID: CVE-2024-33866 State: PUBLISHED Published: 2024-05-14T13:33:33.777Z Last Updated: 2025-02-13T15:52:55.686Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in linqi before 1.4.0.1 on Windows. There is /api/DocumentTemplate/{GUID] XSS. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.linqi.de/de-DE/blog.html - https://linqi.help/Updates/en#/SecurityUpdates
CVE ID: CVE-2024-33867 State: PUBLISHED Published: 2024-05-14T13:34:47.194Z Last Updated: 2025-02-13T15:52:56.199Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in linqi before 1.4.0.1 on Windows. There is a hardcoded password salt. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.linqi.de/de-DE/blog.html - https://linqi.help/Updates/en#/SecurityUpdates
CVE ID: CVE-2024-33868 State: PUBLISHED Published: 2024-05-14T13:35:52.728Z Last Updated: 2025-02-13T15:52:56.721Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in linqi before 1.4.0.1 on Windows. There is LDAP injection. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.linqi.de/de-DE/blog.html - https://linqi.help/Updates/en#/SecurityUpdates
CVE ID: CVE-2024-33869 State: PUBLISHED Published: 2024-07-03T00:00:00 Last Updated: 2024-10-31T17:23:01.163Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Artifex Ghostscript before 10.03.1. Path traversal and command execution can occur (via a crafted PostScript document) because of path reduction in base/gpmisc.c. For example, restrictions on use of %pipe% can be bypassed via the aa/../%pipe%command# output filename. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugs.ghostscript.com/show_bug.cgi?id=707691 - https://www.openwall.com/lists/oss-security/2024/06/28/2
CVE ID: CVE-2024-33870 State: PUBLISHED Published: 2024-07-03T00:00:00 Last Updated: 2024-11-07T21:47:02.092Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Artifex Ghostscript before 10.03.1. There is path traversal (via a crafted PostScript document) to arbitrary files if the current directory is in the permitted paths. For example, there can be a transformation of ../../foo to ./../../foo and this will grant access if ./ is permitted. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugs.ghostscript.com/show_bug.cgi?id=707686 - https://www.openwall.com/lists/oss-security/2024/06/28/2
CVE ID: CVE-2024-33871 State: PUBLISHED Published: 2024-07-03T00:00:00 Last Updated: 2024-08-02T02:42:59.809Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Artifex Ghostscript before 10.03.1. contrib/opvp/gdevopvp.c allows arbitrary code execution via a custom Driver library, exploitable via a crafted PostScript document. This occurs because the Driver parameter for opvp (and oprp) devices can have an arbitrary name for a dynamic library; this library is then loaded. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugs.ghostscript.com/show_bug.cgi?id=707754 - https://cgit.ghostscript.com/cgi-bin/cgit.cg
tainer: References: - https://bugs.ghostscript.com/show_bug.cgi?id=707754 - https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=7145885041bb52cc23964f0aa2aec1b1c82b5908 - https://www.openwall.com/lists/oss-security/2024/06/28/2
CVE ID: CVE-2024-33872 State: PUBLISHED Published: 2024-08-20T00:00:00 Last Updated: 2024-08-20T17:51:25.809Z Vendors: n/a Products: n/a Problem Types: n/a Description: Keyfactor Command 10.5.x before 10.5.1 and 11.5.x before 11.5.1 allows SQL Injection which could result in code execution and escalation of privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://trust.keyfactor.com/?itemUid=d73921fd-bc9e-4e35-a974-cfb628e6a226&source=click
CVE ID: CVE-2024-33873 State: PUBLISHED Published: 2024-05-09T16:46:57.696Z Last Updated: 2025-02-13T15:52:57.240Z Vendors: n/a Products: n/a Problem Types: n/a Description: HDF5 Library through 1.14.3 has a heap-based buffer overflow in H5D__scatter_mem in H5Dscatgath.c. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.hdfgroup.org/2024/05/new-hdf5-cve-issues-fixed-in-1-14-4/
CVE ID: CVE-2024-33874 State: PUBLISHED Published: 2024-05-09T16:47:17.912Z Last Updated: 2025-02-13T15:52:57.793Z Vendors: n/a Products: n/a Problem Types: n/a Description: HDF5 Library through 1.14.3 has a heap buffer overflow in H5O__mtime_new_encode in H5Omtime.c. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.hdfgroup.org/2024/05/new-hdf5-cve-issues-fixed-in-1-14-4/
CVE ID: CVE-2024-33875 State: PUBLISHED Published: 2024-05-09T16:47:36.035Z Last Updated: 2025-02-13T15:52:58.338Z Vendors: n/a Products: n/a Problem Types: n/a Description: HDF5 Library through 1.14.3 has a heap-based buffer overflow in H5O__layout_encode in H5Olayout.c, resulting in the corruption of the instruction pointer. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.hdfgroup.org/2024/05/new-hdf5-cve-issues-fixed-in-1-14-4/
CVE ID: CVE-2024-33876 State: PUBLISHED Published: 2024-05-09T16:47:51.132Z Last Updated: 2025-02-13T15:52:58.926Z Vendors: n/a Products: n/a Problem Types: n/a Description: HDF5 Library through 1.14.3 has a heap buffer overflow in H5S__point_deserialize in H5Spoint.c. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.hdfgroup.org/2024/05/new-hdf5-cve-issues-fixed-in-1-14-4/
CVE ID: CVE-2024-33877 State: PUBLISHED Published: 2024-05-09T16:48:11.314Z Last Updated: 2025-02-13T15:52:59.418Z Vendors: n/a Products: n/a Problem Types: n/a Description: HDF5 Library through 1.14.3 has a heap-based buffer overflow in H5T__conv_struct_opt in H5Tconv.c. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.hdfgroup.org/2024/05/new-hdf5-cve-issues-fixed-in-1-14-4/
CVE ID: CVE-2024-33878 State: REJECTED Published: N/A Last Updated: 2025-02-13T15:53:00.011Z Description: No description available.
CVE ID: CVE-2024-33879 State: PUBLISHED Published: 2024-06-24T00:00:00 Last Updated: 2024-08-02T02:42:59.918Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in VirtoSoftware Virto Bulk File Download 5.5.44 for SharePoint 2019. The Virto.SharePoint.FileDownloader/Api/Download.ashx isCompleted method allows arbitrary file download and deletion via absolute path traversal in the path parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://docs.virtosoftware.com/v/virto-security-frequently-asked-questions-faq - https://download.virtosoftware.com/Manuals/nu_ncsc_virto_one_bulk_file_download_v5.4.4_pt_disclosu
asked-questions-faq - https://download.virtosoftware.com/Manuals/nu_ncsc_virto_one_bulk_file_download_v5.4.4_pt_disclosure.pdf
CVE ID: CVE-2024-33880 State: PUBLISHED Published: 2024-06-24T00:00:00.000Z Last Updated: 2025-03-19T17:54:19.865Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in VirtoSoftware Virto Bulk File Download 5.5.44 for SharePoint 2019. It discloses full pathnames via Virto.SharePoint.FileDownloader/Api/Download.ashx?action=archive. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://download.virtosoftware.com/Manuals/nu_ncsc_virto_one_bulk_file_download_v5.4.4_pt_disclosure.pdf - https://docs.virtosoftware.com/v/virto-security-frequently-asked-questions-faq&gt%3B
CVE ID: CVE-2024-33881 State: PUBLISHED Published: 2024-06-24T00:00:00 Last Updated: 2024-09-15T19:20:42.987Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in VirtoSoftware Virto Bulk File Download 5.5.44 for SharePoint 2019. The Virto.SharePoint.FileDownloader/Api/Download.ashx isCompleted method allows an NTLMv2 hash leak via a UNC share pathname in the path parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://docs.virtosoftware.com/v/virto-security-frequently-asked-questions-faq - https://download.virtosoftware.com/Manuals/nu_ncsc_virto_one_bulk_file_download_v5.4.4_pt_disclosure.pdf
CVE ID: CVE-2024-33883 State: PUBLISHED Published: 2024-04-28T00:00:00 Last Updated: 2024-08-02T02:42:59.934Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ejs (aka Embedded JavaScript templates) package before 3.1.10 for Node.js lacks certain pollution protection. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/mde/ejs/commit/e469741dca7df2eb400199e1cdb74621e3f89aa5 - https://github.com/mde/ejs/compare/v3.1.9...v3.1.10 - https://security.netapp.com/advisory/ntap-20240605-0003/
CVE ID: CVE-2024-33891 State: PUBLISHED Published: 2024-04-28T00:00:00.000Z Last Updated: 2025-02-12T14:59:33.572Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:L/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: Delinea Secret Server before 11.7.000001 allows attackers to bypass authentication via the SOAP API in SecretServer/webservices/SSWebService.asmx. This is related to a hardcoded key, the use of the integer 2 for the Admin user, and removal of the oauthExpirationId attribute. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://delinea.com/products/secret-server - https://straightblast.medium.com/all-your-se
ogram Container: References: - https://delinea.com/products/secret-server - https://straightblast.medium.com/all-your-secrets-are-belong-to-us-a-delinea-secret-server-authn-authz-bypass-adc26c800ad3 - https://docs.delinea.com/online-help/secret-server/release-notes/ss-rn-11-7-000001.htm - https://trust.delinea.com/?tcuUid=17aaf4ef-ada9-46d5-bf97-abd3b07daae3
CVE ID: CVE-2024-33892 State: PUBLISHED Published: 2024-08-02T00:00:00.000Z Last Updated: 2025-11-04T16:12:14.584Z Vendors: n/a Products: n/a Problem Types: n/a Description: Insecure Permissions vulnerability in Cosy+ devices running a firmware 21.x below 21.2s10 or a firmware 22.x below 22.1s3 are susceptible to leaking information through cookies. This is fixed in version 21.2s10 and 22.1s3 Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ewon.biz/products/cosy/ewon-cosy-wifi - https://www.hms-networks.com/cyber-security - https://hmsnetworks.blob.core.windows.net/nlw/docs/default-source/products/cybersecurity/security-advisory/hms-secur
y - https://hmsnetworks.blob.core.windows.net/nlw/docs/default-source/products/cybersecurity/security-advisory/hms-security-advisory-2024-07-29-001--ewon-several-cosy--vulnerabilities.pdf - https://blog.syss.com/posts/hacking-a-secure-industrial-remote-access-gateway/
CVE ID: CVE-2024-33893 State: PUBLISHED Published: 2024-08-02T00:00:00.000Z Last Updated: 2025-11-04T16:12:15.562Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cosy+ devices running a firmware 21.x below 21.2s10 or a firmware 22.x below 22.1s3 are vulnerable to XSS when displaying the logs due to improper input sanitization. This is fixed in version 21.2s10 and 22.1s3. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ewon.biz/products/cosy/ewon-cosy-wifi - https://www.hms-networks.com/cyber-security - https://hmsnetworks.blob.core.windows.net/nlw/docs/default-source/products/cybersecurity/security-advisory/hms-security-adviso
//hmsnetworks.blob.core.windows.net/nlw/docs/default-source/products/cybersecurity/security-advisory/hms-security-advisory-2024-07-29-001--ewon-several-cosy--vulnerabilities.pdf - https://blog.syss.com/posts/hacking-a-secure-industrial-remote-access-gateway/
CVE ID: CVE-2024-33894 State: PUBLISHED Published: 2024-08-02T00:00:00 Last Updated: 2024-08-18T09:02:45.273Z Vendors: n/a Products: n/a Problem Types: n/a Description: Insecure Permission vulnerability in Cosy+ devices running a firmware 21.x below 21.2s10 or a firmware 22.x below 22.1s3 are executing several processes with elevated privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ewon.biz/products/cosy/ewon-cosy-wifi - https://www.hms-networks.com/cyber-security - https://hmsnetworks.blob.core.windows.net/nlw/docs/default-source/products/cybersecurity/security-advisory/hms-security-advisory-2024-07-29-001--ewon-several-cosy--
w/docs/default-source/products/cybersecurity/security-advisory/hms-security-advisory-2024-07-29-001--ewon-several-cosy--vulnerabilities.pdf - https://blog.syss.com/posts/hacking-a-secure-industrial-remote-access-gateway/
CVE ID: CVE-2024-33895 State: PUBLISHED Published: 2024-08-02T00:00:00.000Z Last Updated: 2025-11-04T16:12:16.505Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cosy+ devices running a firmware 21.x below 21.2s10 or a firmware 22.x below 22.1s3 use a unique key to encrypt the configuration parameters. This is fixed in version 21.2s10 and 22.1s3, the key is now unique per device. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ewon.biz/products/cosy/ewon-cosy-wifi - https://www.hms-networks.com/cyber-security - https://hmsnetworks.blob.core.windows.net/nlw/docs/default-source/products/cybersecurity/security-advisory/hms-securi
- https://hmsnetworks.blob.core.windows.net/nlw/docs/default-source/products/cybersecurity/security-advisory/hms-security-advisory-2024-07-29-001--ewon-several-cosy--vulnerabilities.pdf - https://blog.syss.com/posts/hacking-a-secure-industrial-remote-access-gateway/
CVE ID: CVE-2024-33896 State: PUBLISHED Published: 2024-08-02T00:00:00.000Z Last Updated: 2025-11-04T16:12:17.529Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cosy+ devices running a firmware 21.x below 21.2s10 or a firmware 22.x below 22.1s3 are vulnerable to code injection due to improper parameter blacklisting. This is fixed in version 21.2s10 and 22.1s3. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ewon.biz/products/cosy/ewon-cosy-wifi - https://www.hms-networks.com/cyber-security - https://hmsnetworks.blob.core.windows.net/nlw/docs/default-source/products/cybersecurity/security-advisory/hms-security-advisory-2024-07
rks.blob.core.windows.net/nlw/docs/default-source/products/cybersecurity/security-advisory/hms-security-advisory-2024-07-29-001--ewon-several-cosy--vulnerabilities.pdf - https://blog.syss.com/posts/hacking-a-secure-industrial-remote-access-gateway/
CVE ID: CVE-2024-33897 State: PUBLISHED Published: 2024-08-06T00:00:00 Last Updated: 2024-08-22T23:03:06.344Z Vendors: n/a Products: n/a Problem Types: n/a Description: A compromised HMS Networks Cosy+ device could be used to request a Certificate Signing Request from Talk2m for another device, resulting in an availability issue. The issue was patched on the Talk2m production server on April 18, 2024. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ewon.biz/products/cosy/ewon-cosy-wifi - https://www.hms-networks.com/cyber-security - https://hmsnetworks.blob.core.windows.net/nlw/docs/default-source/products/cybersecurity/security-advisory/
r-security - https://hmsnetworks.blob.core.windows.net/nlw/docs/default-source/products/cybersecurity/security-advisory/hms-security-advisory-2024-07-29-001--ewon-several-cosy--vulnerabilities.pdf - https://blog.syss.com/posts/hacking-a-secure-industrial-remote-access-gateway/
CVE ID: CVE-2024-33898 State: PUBLISHED Published: 2024-06-24T00:00:00.000Z Last Updated: 2025-02-06T21:30:49.505Z Vendors: n/a Products: n/a Problem Types: n/a Description: Axiros AXESS Auto Configuration Server (ACS) 4.x and 5.0.0 is affected by an Incorrect Access Control vulnerability. An authorization bypass allows remote attackers to achieve unauthenticated remote code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.axiros.com/2024/03/vulnerability-in-axusermanager - https://www.nsideattacklogic.de/advisories/NSIDE-SA-2024-002
CVE ID: CVE-2024-33899 State: PUBLISHED Published: 2024-04-28T00:00:00 Last Updated: 2024-08-02T02:42:59.602Z Vendors: n/a Products: n/a Problem Types: n/a Description: RARLAB WinRAR before 7.00, on Linux and UNIX platforms, allows attackers to spoof the screen output, or cause a denial of service, via ANSI escape sequences. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.rarlab.com/rarnew.htm - https://sdushantha.medium.com/ansi-escape-injection-vulnerability-in-winrar-a2cbfac4b983
CVE ID: CVE-2024-33900 State: PUBLISHED Published: 2024-05-20T20:29:54.072Z Last Updated: 2025-02-13T15:53:00.579Z Vendors: n/a Products: n/a Problem Types: n/a Description: KeePassXC 2.7.7 allows an attacker (who has the privileges of the victim) to recover cleartext credentials via a memory dump. NOTE: the vendor disputes this because memory-management constraints make this unavoidable in the current design and other realistic designs. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://keepassxc.org/blog/ - https://gist.github.com/Fastor01/30c6d89c842feb1865ec2cd2d3806838 - https://github.com/keepassxreboot/keepassxc/issues/10784 - https://kee
b.com/Fastor01/30c6d89c842feb1865ec2cd2d3806838 - https://github.com/keepassxreboot/keepassxc/issues/10784 - https://keepassxc.org/blog/2019-02-21-memory-security/
CVE ID: CVE-2024-33901 State: PUBLISHED Published: 2024-05-20T20:21:40.789Z Last Updated: 2025-02-13T15:53:01.159Z Vendors: n/a Products: n/a Problem Types: n/a Description: Issue in KeePassXC 2.7.7 allows an attacker (who has the privileges of the victim) to recover some passwords stored in the .kdbx database via a memory dump. NOTE: the vendor disputes this because memory-management constraints make this unavoidable in the current design and other realistic designs. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://keepassxc.org/blog/ - https://gist.github.com/Fastor01/30c6d89c842feb1865ec2cd2d3806838 - https://github.com/keepassxreboot/keepa
.org/blog/ - https://gist.github.com/Fastor01/30c6d89c842feb1865ec2cd2d3806838 - https://github.com/keepassxreboot/keepassxc/issues/10784 - https://keepassxc.org/blog/2019-02-21-memory-security/