Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-41984 State: PUBLISHED Published: 2025-08-12T11:16:39.989Z Last Updated: 2025-08-12T19:33:52.329Z Severity: LOW (CVSS 2.6 CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: Siemens Products: SmartClient modules Opcenter QL Home (SC), SOA Audit, SOA Cockpit Problem Types: CWE-209 Description: A vulnerability has been identified in SmartClient modules Opcenter QL Home (SC) (All versions >= V13.2 < V2506), SOA Audit (All versions >= V13.2 < V2506), SOA Cockpit (All versions >= V13.2 < V2506). The affected application improperly handles error while accessing an inaccessible resource leading to exposing the system applications. Additional Analyst Notes: - CISA ADP Vulnrichmen
g an inaccessible resource leading to exposing the system applications. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-382999.html
CVE ID: CVE-2024-41985 State: PUBLISHED Published: 2025-08-12T11:16:41.301Z Last Updated: 2025-08-12T19:25:28.707Z Severity: LOW (CVSS 2.6 CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Siemens Products: SmartClient modules Opcenter QL Home (SC), SOA Audit, SOA Cockpit Problem Types: CWE-613 Description: A vulnerability has been identified in SmartClient modules Opcenter QL Home (SC) (All versions >= V13.2 < V2506), SOA Audit (All versions >= V13.2 < V2506), SOA Cockpit (All versions >= V13.2 < V2506). The affected application does not expire the session without logout. This could allow an attacker to get unauthorized access if the session is left idle. Additional Analyst Notes: - CI
out. This could allow an attacker to get unauthorized access if the session is left idle. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-382999.html
CVE ID: CVE-2024-41986 State: PUBLISHED Published: 2025-08-12T11:16:42.595Z Last Updated: 2025-08-12T19:16:56.687Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L) Vendors: Siemens Products: SmartClient modules Opcenter QL Home (SC), SOA Audit, SOA Cockpit Problem Types: CWE-327 Description: A vulnerability has been identified in SmartClient modules Opcenter QL Home (SC) (All versions >= V13.2 < V2506), SOA Audit (All versions >= V13.2 < V2506), SOA Cockpit (All versions >= V13.2 < V2506). The affected application support insecure TLS 1.0 and 1.1 protocol. An attacker could achieve a man-in-the-middle attack and compromise confidentiality and integrity of data. Additi
tocol. An attacker could achieve a man-in-the-middle attack and compromise confidentiality and integrity of data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-382999.html
CVE ID: CVE-2024-41987 State: PUBLISHED Published: 2024-10-03T17:38:49.500Z Last Updated: 2024-10-03T18:49:33.596Z Vendors: TEM Products: Opera Plus FM Family Transmitter Problem Types: CWE-352 Description: The TEM Opera Plus FM Family Transmitter application interface allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can be exploited to perform certain actions with administrative privileges if a logged-in user visits a malicious web site. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-277-01
CVE ID: CVE-2024-41988 State: PUBLISHED Published: 2024-10-03T17:40:07.153Z Last Updated: 2024-10-03T18:48:36.617Z Vendors: TEM Products: Opera Plus FM Family Transmitter Problem Types: CWE-306 Description: TEM Opera Plus FM Family Transmitter allows access to an unprotected endpoint that allows MPFS File System binary image upload without authentication. This file system serves as the basis for the HTTP2 web server module but is also used by the SNMP module and is available to other applications that require basic read-only storage capabilities. This can be exploited to overwrite the flash program memory that holds the web server's main interfaces and execute arbitrary code. Additional Anal
erwrite the flash program memory that holds the web server's main interfaces and execute arbitrary code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-277-01
CVE ID: CVE-2024-41989 State: PUBLISHED Published: 2024-08-07T00:00:00.000Z Last Updated: 2025-11-04T16:13:40.784Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The floatformat template filter is subject to significant memory consumption when given a string representation of a number in scientific notation with a large exponent. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://docs.djangoproject.com/en/dev/releases/security/ - https://groups.google.com/forum/#%21forum/django-announce - https://www.djangoproject.com/weblog/2024/aug/06/security-releases/
CVE ID: CVE-2024-41990 State: PUBLISHED Published: 2024-08-07T00:00:00.000Z Last Updated: 2025-11-04T16:13:41.723Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The urlize() and urlizetrunc() template filters are subject to a potential denial-of-service attack via very large inputs with a specific sequence of characters. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://docs.djangoproject.com/en/dev/releases/security/ - https://groups.google.com/forum/#%21forum/django-announce - https://www.djangoproject.com/weblog/2024/aug/06/security-releases/
CVE ID: CVE-2024-41991 State: PUBLISHED Published: 2024-08-07T00:00:00.000Z Last Updated: 2025-11-04T16:13:42.653Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The urlize and urlizetrunc template filters, and the AdminURLFieldWidget widget, are subject to a potential denial-of-service attack via certain inputs with a very large number of Unicode characters. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://docs.djangoproject.com/en/dev/releases/security/ - https://groups.google.com/forum/#%21forum/django-announce - https://www.djangoproject.com/weblog/2024/a
ases/security/ - https://groups.google.com/forum/#%21forum/django-announce - https://www.djangoproject.com/weblog/2024/aug/06/security-releases/
CVE ID: CVE-2024-41992 State: PUBLISHED Published: 2024-11-11T00:00:00 Last Updated: 2024-11-12T17:16:19.610Z Vendors: n/a Products: n/a Problem Types: n/a Description: Wi-Fi Alliance wfa_dut (in Wi-Fi Test Suite) through 9.0.0 allows OS command injection via 802.11x frames because the system() library function is used. For example, on Arcadyan FMIMG51AX000J devices, this leads to wfaTGSendPing remote code execution as root via traffic to TCP port 8000 or 8080 on a LAN interface. On other devices, this may be exploitable over a WAN interface. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://ssd-disclosure.com/ssd-advisory-arcadyan-fmimg51ax000
Program Container: - CISA ADP Vulnrichment: References: - https://ssd-disclosure.com/ssd-advisory-arcadyan-fmimg51ax000j-wifi-alliance-rce/
CVE ID: CVE-2024-41995 State: PUBLISHED Published: 2024-08-06T06:51:51.329Z Last Updated: 2025-03-24T17:15:35.878Z Vendors: Ricoh Company, Ltd. Products: JavaTM Platform Problem Types: Initialization of a Resource with an Insecure Default Description: Initialization of a resource with an insecure default vulnerability exists in JavaTM Platform Ver.12.89 and earlier. If this vulnerability is exploited, the product may be affected by some known TLS1.0 and TLS1.1 vulnerabilities. As for the specific products/models/versions of MFPs and printers that contain JavaTM Platform, see the information provided by the vendor. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.r
e the information provided by the vendor. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ricoh.com/products/security/vulnerabilities/vul?id=ricoh-2024-000010 - https://jp.ricoh.com/security/products/vulnerabilities/vul?id=ricoh-2024-000010 - https://jvn.jp/en/jp/JVN78728294/
CVE ID: CVE-2024-41996 State: PUBLISHED Published: 2024-08-26T00:00:00 Last Updated: 2024-08-26T15:17:29.404Z Vendors: n/a Products: n/a Problem Types: n/a Description: Validating the order of the public keys in the Diffie-Hellman Key Agreement Protocol, when an approved safe prime is used, allows remote attackers (from the client side) to trigger unnecessarily expensive server-side DHE modular-exponentiation calculations. The client may cause asymmetric resource consumption. The basic attack scenario is that the client must claim that it can only communicate with DHE, and the server must be configured to allow DHE and validate the order of the public key. Additional Analyst Notes: - CISA AD
the server must be configured to allow DHE and validate the order of the public key. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gist.github.com/c0r0n3r/abccc14d4d96c0442f3a77fa5ca255d1 - https://dheatattack.gitlab.io/details/ - https://dheatattack.gitlab.io/faq/
CVE ID: CVE-2024-41997 State: PUBLISHED Published: 2024-10-14T00:00:00 Last Updated: 2024-10-16T19:31:11.179Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in version of Warp Terminal prior to 2024.07.18 (v0.2024.07.16.08.02). A command injection vulnerability exists in the Docker integration functionality. An attacker can create a specially crafted hyperlink using the `warp://action/docker/open_subshell` intent that when clicked by the victim results in command execution on the victim's machine. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/warpdotdev/warp - https://gist.github.com/bhyh/d1ee7a825fce283bf8acbdb42c8a78
richment: References: - https://github.com/warpdotdev/warp - https://gist.github.com/bhyh/d1ee7a825fce283bf8acbdb42c8a7832 - https://docs.warp.dev/getting-started/changelog#id-2024.07.18-v0.2024.07.16.08.02 - https://docs.warp.dev/features/integrations-and-plugins#docker
CVE ID: CVE-2024-41999 State: PUBLISHED Published: 2024-09-30T07:50:34.536Z Last Updated: 2024-09-30T16:45:01.184Z Severity: MEDIUM (CVSS 6.8 CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: TECHNO SUPPORT COMPANY Products: Smart-tab Android app Problem Types: CWE-489 Description: Smart-tab Android app installed April 2023 or earlier contains an active debug code vulnerability. If this vulnerability is exploited, an attacker with physical access to the device may exploit the debug function to gain access to the OS functions, escalate the privilege, change the device's settings, or spoof devices in other rooms. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://tsc
settings, or spoof devices in other rooms. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://tsc-soft.co.jp/smart-tab/ - https://jvn.jp/en/jp/JVN42445661/
CVE ID: CVE-2024-42000 State: PUBLISHED Published: 2024-11-09T17:17:25.038Z Last Updated: 2024-11-12T14:53:08.813Z Severity: LOW (CVSS 2.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N) Vendors: Mattermost Products: Mattermost Problem Types: CWE-863 Description: Mattermost versions 9.10.x <= 9.10.2, 9.11.x <= 9.11.1, 9.5.x <= 9.5.9 and 10.0.x <= 10.0.0 fail to properly authorize the requests to /api/v4/channels which allows a User or System Manager, with "Read Groups" permission but with no access for channels to retrieve details about private channels that they were not a member of by sending a request to /api/v4/channels. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http
ember of by sending a request to /api/v4/channels. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2024-42001 State: PUBLISHED Published: 2024-08-08T19:39:49.024Z Last Updated: 2024-08-21T20:04:53.127Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H) Vendors: Vonets Products: VAR1200-H, VAR1200-L, VAR600-H, VAP11AC, VAP11G-500S, VBG1200, VAP11S-5G, VAP11S, VAR11N-300, VAP11G-300, VAP11N-300, VAP11G, VAP11G-500, VGA-1000 Problem Types: CWE-425 Description: An improper authentication vulnerability affecting Vonets industrial wifi bridge relays and wifi bridge repeaters, software versions 3.3.23.6.9 and prior enables an unauthenticated remote attacker to bypass authentication via a specially crafted direct request when another user has an active session. Add
te attacker to bypass authentication via a specially crafted direct request when another user has an active session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-214-08
CVE ID: CVE-2024-42004 State: PUBLISHED Published: 2024-12-18T22:40:14.307Z Last Updated: 2024-12-19T16:45:56.860Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: Microsoft Products: Teams (work or school) Problem Types: CWE-347 Description: A library injection vulnerability exists in Microsoft Teams (work or school) 24046.2813.2770.1094 for macOS. A specially crafted library can leverage Teams's access privileges, leading to a permission bypass. A malicious application could inject a library and start the program to trigger this vulnerability and then make use of the vulnerable application's permissions. Additional Analyst Notes: - CVE Program Container: - CI
y and then make use of the vulnerable application's permissions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2024-1973
CVE ID: CVE-2024-42005 State: PUBLISHED Published: 2024-08-07T00:00:00.000Z Last Updated: 2025-11-04T16:13:43.599Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. QuerySet.values() and values_list() methods on models with a JSONField are subject to SQL injection in column aliases via a crafted JSON object key as a passed *arg. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://docs.djangoproject.com/en/dev/releases/security/ - https://groups.google.com/forum/#%21forum/django-announce - https://www.djangoproject.com/weblog/2024/aug/06/security-releases/
CVE ID: CVE-2024-42006 State: PUBLISHED Published: 2024-08-20T00:00:00.000Z Last Updated: 2025-03-18T19:19:00.307Z Vendors: n/a Products: n/a Problem Types: n/a Description: Keyfactor AWS Orchestrator through 2.0 allows Information Disclosure. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://trust.keyfactor.com/?itemUid=d73921fd-bc9e-4e35-a974-cfb628e6a226&source=click
CVE ID: CVE-2024-42007 State: PUBLISHED Published: 2024-07-26T00:00:00 Last Updated: 2024-08-19T07:47:52.431Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AC:L/AV:N/A:N/C:L/I:N/PR:N/S:C/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: SPX (aka php-spx) through 0.4.15 allows SPX_UI_URI Directory Traversal to read arbitrary files. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/NoiseByNorthwest/php-spx/issues/251
CVE ID: CVE-2024-42008 State: PUBLISHED Published: 2024-08-05T00:00:00.000Z Last Updated: 2025-03-13T15:35:39.477Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross-Site Scripting vulnerability in rcmail_action_mail_get->run() in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a malicious e-mail attachment served with a dangerous Content-Type header. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/roundcube/roundcubemail/releases - https://sonarsource.com/blog/government-emails-at-risk-critical-cross-site-scripting-vulnerability-in-roundcube-webmail/ - https://github.com/rou
log/government-emails-at-risk-critical-cross-site-scripting-vulnerability-in-roundcube-webmail/ - https://github.com/roundcube/roundcubemail/releases/tag/1.5.8 - https://github.com/roundcube/roundcubemail/releases/tag/1.6.8 - https://roundcube.net/news/2024/08/04/security-updates-1.6.8-and-1.5.8
CVE ID: CVE-2024-42009 State: PUBLISHED Published: 2024-08-05T00:00:00.000Z Last Updated: 2025-10-21T22:55:48.964Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in message_body() in program/actions/mail/show.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/roundcube/roundcubemail/releases - https://sonarsource.com/blog/government-emails-at-risk-critical-cross-site-scripting-vulnerability-in-roundcube-webmail/ - https://github.com
om/blog/government-emails-at-risk-critical-cross-site-scripting-vulnerability-in-roundcube-webmail/ - https://github.com/roundcube/roundcubemail/releases/tag/1.5.8 - https://github.com/roundcube/roundcubemail/releases/tag/1.6.8 - https://roundcube.net/news/2024/08/04/security-updates-1.6.8-and-1.5.8
CVE ID: CVE-2024-42010 State: PUBLISHED Published: 2024-08-05T00:00:00 Last Updated: 2024-08-12T13:42:04.196708 Vendors: n/a Products: n/a Problem Types: n/a Description: mod_css_styles in Roundcube through 1.5.7 and 1.6.x through 1.6.7 insufficiently filters Cascading Style Sheets (CSS) token sequences in rendered e-mail messages, allowing a remote attacker to obtain sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/roundcube/roundcubemail/releases - https://sonarsource.com/blog/government-emails-at-risk-critical-cross-site-scripting-vulnerability-in-roundcube-webmail/ - https://github.com/roundcube/roundcubemail/releases/tag/1.5.8 -
ss-site-scripting-vulnerability-in-roundcube-webmail/ - https://github.com/roundcube/roundcubemail/releases/tag/1.5.8 - https://github.com/roundcube/roundcubemail/releases/tag/1.6.8 - https://roundcube.net/news/2024/08/04/security-updates-1.6.8-and-1.5.8
CVE ID: CVE-2024-42011 State: PUBLISHED Published: 2024-10-28T00:00:00 Last Updated: 2024-10-30T17:34:33.888Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Spotify app 8.9.58 for iOS has a buffer overflow in its use of strcat. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://luminous-reminder-337.notion.site/Buffer-Overflow-Vulnerability-in-Spotify-iOS-App-Steps-to-Reproduce-By-0xRushy-5114aa2548e2401eb6812a12af888b8c - https://community.spotify.com/t5/iOS-iPhone-iPad/Spotify-constantly-crashes-lags-and-heats-up-my-battery/td-p/6217537
CVE ID: CVE-2024-42012 State: PUBLISHED Published: 2025-01-22T00:00:00.000Z Last Updated: 2025-02-04T18:44:05.333Z Vendors: n/a Products: n/a Problem Types: n/a Description: GRAU DATA Blocky before 3.1 stores passwords encrypted rather than hashed. At the login screen, the user's password is compared to the user's decrypted cleartext password. An attacker with Windows admin or debugging rights can therefore steal the user's Blocky password and from there impersonate that local user. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.graudata.com/en/products/protection-against-ransomware/blocky-for-veeam/ - https://www.blockyforveeam.com/en/security-bulletin-2024-06-
/products/protection-against-ransomware/blocky-for-veeam/ - https://www.blockyforveeam.com/en/security-bulletin-2024-06-25/
CVE ID: CVE-2024-42013 State: PUBLISHED Published: 2025-01-22T00:00:00.000Z Last Updated: 2025-02-04T18:46:52.694Z Vendors: n/a Products: n/a Problem Types: n/a Description: In GRAU DATA Blocky before 3.1, Blocky-Gui has a Client-Side Enforcement of Server-Side Security vulnerability. An attacker with Windows administrative or debugging privileges can patch a binary in memory or on disk to bypass the password login requirement and gain full access to all functions of the program. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.graudata.com/en/products/protection-against-ransomware/blocky-for-veeam/ - https://www.blockyforveeam.com/en/security-bulletin-2024-06-25/
CVE ID: CVE-2024-42017 State: PUBLISHED Published: 2024-09-30T00:00:00 Last Updated: 2024-10-29T14:47:57.521Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:C/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Atos Eviden iCare 2.7.1 through 2.7.11. The application exposes a web interface locally. In the worst-case scenario, if the application is remotely accessible, it allows an attacker to execute arbitrary commands with system privilege on the endpoint hosting the application, without any authentication. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://eviden.com - https://support.bull.com/ols/product/secu
nal Analyst Notes: - CISA ADP Vulnrichment: References: - https://eviden.com - https://support.bull.com/ols/product/security/psirt/security-bulletins/multiple-critical-vulnerabilities-in-icare-psirt-625-tlp-clear-version-0-7-cve-2024-42017/view
CVE ID: CVE-2024-42018 State: PUBLISHED Published: 2024-10-11T00:00:00 Last Updated: 2024-11-06T19:36:06.260Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Atos Eviden SMC xScale before 1.6.6. During initialization of nodes, some configuration parameters are retrieved from management nodes. These parameters embed credentials whose integrity and confidentiality may be important to the security of the HPC configuration. Because these parameters are needed for initialization, there is no available mechanism to ensure access control on the management node, and a mitigation measure is normally put in place to prevent access to unprivileged users. It was dis
e management node, and a mitigation measure is normally put in place to prevent access to unprivileged users. It was discovered that this mitigation measure does not survive a reboot of diskful nodes. (Diskless nodes are not at risk.) The mistake lies in the cloudinit configuration: the iptables configuration should have been in the bootcmd instead of the runcmd section. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://eviden.com - https://support.bull.com/ols/product/security/psirt/security-bulletins/misconfiguration-of-smc-xscale-leads-to-sensitive-data-exposure-psirt-1369-tlp-clear-version-2-6-cve-2024-42018/view
CVE ID: CVE-2024-42019 State: PUBLISHED Published: 2024-09-07T16:11:22.117Z Last Updated: 2024-09-09T16:41:08.546Z Severity: CRITICAL (CVSS 9 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: Veeam Products: One Description: A vulnerability that allows an attacker to access the NTLM hash of the Veeam Reporter Service service account. This attack requires user interaction and data collected from Veeam Backup & Replication. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.veeam.com/kb4649
CVE ID: CVE-2024-42020 State: PUBLISHED Published: 2024-09-07T16:11:22.194Z Last Updated: 2024-10-27T14:31:53.241Z Severity: HIGH (CVSS 7.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H) Vendors: Veeam Products: One Description: A Cross-site-scripting (XSS) vulnerability exists in the Reporter Widgets that allows HTML injection. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.veeam.com/kb4649
CVE ID: CVE-2024-42021 State: PUBLISHED Published: 2024-09-07T16:11:22.333Z Last Updated: 2024-09-09T13:33:58.971Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Veeam Products: One Description: An improper access control vulnerability allows an attacker with valid access tokens to access saved credentials. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.veeam.com/kb4649