Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation) Problem Types: CWE-416 Description: Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38252
CVE ID: CVE-2024-38253 State: PUBLISHED Published: 2024-09-10T16:53:48.103Z Last Updated: 2024-12-31T23:02:54.805Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 11 version 21H2, Windows 11 version 22H2, Windows 11 version 22H3, Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 Version 24H2 Problem Types: CWE-416 Description: Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38253
CVE ID: CVE-2024-38254 State: PUBLISHED Published: 2024-09-10T16:53:48.572Z Last Updated: 2024-12-31T23:02:55.367Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 11 version 21H2, Windows 10 Version 21H2, Windows 11 version 22H2, Windows 10 Version 22H2, Windows 11 version 22H3, Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 Version 24H2, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation)
2, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation) Problem Types: CWE-908 Description: Windows Authentication Information Disclosure Vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38254
CVE ID: CVE-2024-38255 State: PUBLISHED Published: 2024-11-12T17:53:50.155Z Last Updated: 2025-07-08T15:41:17.036Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft SQL Server 2017 (GDR), Microsoft SQL Server 2019 (GDR), Microsoft SQL Server 2016 Service Pack 3 (GDR), Microsoft SQL Server 2016 Service Pack 3 Azure Connect Feature Pack, Microsoft SQL Server 2017 (CU 31), Microsoft SQL Server 2019 (CU 29) Problem Types: CWE-122 Description: SQL Server Native Client Remote Code Execution Vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE
ditional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38255
CVE ID: CVE-2024-38256 State: PUBLISHED Published: 2024-09-10T16:53:49.163Z Last Updated: 2024-12-31T23:02:55.921Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows 10 Version 21H2, Windows 10 Version 22H2, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Service P
stallation), Windows Server 2008 Service Pack 2, Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: CWE-908 Description: Windows Kernel-Mode Driver Information Disclosure Vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38256
CVE ID: CVE-2024-38257 State: PUBLISHED Published: 2024-09-10T16:54:06.956Z Last Updated: 2024-12-31T23:03:13.315Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 11 version 21H2, Windows 10 Version 21H2, Windows 11 version 22H2, Windows 10 Version 22H2, Windows 11 version 22H3, Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation) Problem Types: CWE-908 Description: Microsoft AllJo
Windows Server 2016, Windows Server 2016 (Server Core installation) Problem Types: CWE-908 Description: Microsoft AllJoyn API Information Disclosure Vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38257
CVE ID: CVE-2024-38258 State: PUBLISHED Published: 2024-09-10T16:54:07.486Z Last Updated: 2024-12-31T23:03:13.925Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows Server 2022, 23H2 Edition (Server Core installation), Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Server Core installation), Windows
ack 2, Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: CWE-23 Description: Windows Remote Desktop Licensing Service Information Disclosure Vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38258
CVE ID: CVE-2024-38259 State: PUBLISHED Published: 2024-09-10T16:54:08.162Z Last Updated: 2024-12-31T23:03:14.447Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows Server 2022, Windows 11 version 21H2, Windows 11 version 22H2, Windows 11 version 22H3, Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 Version 24H2 Problem Types: CWE-416 Description: Microsoft Management Console Remote Code Execution Vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38259
CVE ID: CVE-2024-38260 State: PUBLISHED Published: 2024-09-10T16:54:08.796Z Last Updated: 2024-12-31T23:03:15.165Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows Server 2022, 23H2 Edition (Server Core installation), Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Pr
ows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: CWE-908 Description: Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38260
CVE ID: CVE-2024-38261 State: PUBLISHED Published: 2024-10-08T17:35:14.919Z Last Updated: 2025-07-08T15:38:23.666Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows Server 2022, 23H2 Edition (Server Core installation), Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Server Core installation), Windows Se
k 2, Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: CWE-20, CWE-122, CWE-126 Description: Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38261
CVE ID: CVE-2024-38262 State: PUBLISHED Published: 2024-10-08T17:35:43.371Z Last Updated: 2025-07-08T15:38:57.600Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows Server 2022, 23H2 Edition (Server Core installation), Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Server Core installation), Windows Se
k 2, Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: CWE-591 Description: Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38262
CVE ID: CVE-2024-38263 State: PUBLISHED Published: 2024-09-10T16:54:09.298Z Last Updated: 2024-12-31T23:03:15.724Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows Server 2022, 23H2 Edition (Server Core installation), Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Server Core installation), Windows Se
k 2, Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: CWE-591 Description: Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38263
CVE ID: CVE-2024-38264 State: PUBLISHED Published: 2024-11-12T17:53:50.740Z Last Updated: 2025-07-08T15:41:17.734Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows Server 2025, Windows Server 2025 (Server Core installation), Windows 11 version 22H2, Windows 11 version 22H3, Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 Version 24H2 Problem Types: CWE-591 Description: Microsoft Virtual Hard Disk (VHDX) Denial of Service Vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38264
CVE ID: CVE-2024-38265 State: PUBLISHED Published: 2024-10-08T17:35:42.759Z Last Updated: 2025-07-08T15:38:57.034Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows Server 2022, 23H2 Edition (Server Core installation), Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Server Core installation), Windows Se
k 2, Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: CWE-20, CWE-122, CWE-126 Description: Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38265
CVE ID: CVE-2024-38266 State: PUBLISHED Published: 2024-09-24T01:26:31.998Z Last Updated: 2024-09-24T15:40:29.933Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: Zyxel Products: VMG8825-T50K firmware Problem Types: CWE-119 Description: An improper restriction of operations within the bounds of a memory buffer in the parameter type parser of the Zyxel VMG8825-T50K firmware versions through 5.50(ABOM.8)C0 could allow an authenticated attacker with administrator privileges to cause potential memory corruptions, resulting in a thread crash on an affected device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zyxel.com/global/en/sup
an affected device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-post-authentication-memory-corruption-vulnerabilities-in-some-dsl-ethernet-cpe-fiber-ont-wifi-extender-and-security-router-versions-09-24-2024
CVE ID: CVE-2024-38267 State: PUBLISHED Published: 2024-09-24T01:30:45.720Z Last Updated: 2024-09-24T15:38:34.787Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: Zyxel Products: VMG8825-T50K firmware Problem Types: CWE-119 Description: An improper restriction of operations within the bounds of a memory buffer in the IPv6 address parser of the Zyxel VMG8825-T50K firmware versions through 5.50(ABOM.8)C0 could allow an authenticated attacker with administrator privileges to cause potential memory corruptions, resulting in a thread crash on an affected device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zyxel.com/global/en/suppo
affected device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-post-authentication-memory-corruption-vulnerabilities-in-some-dsl-ethernet-cpe-fiber-ont-wifi-extender-and-security-router-versions-09-24-2024
CVE ID: CVE-2024-38268 State: PUBLISHED Published: 2024-09-24T01:35:22.675Z Last Updated: 2024-09-24T15:37:58.810Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: Zyxel Products: VMG8825-T50K firmware Problem Types: CWE-119 Description: An improper restriction of operations within the bounds of a memory buffer in the MAC address parser of the Zyxel VMG8825-T50K firmware versions through 5.50(ABOM.8)C0 could allow an authenticated attacker with administrator privileges to cause potential memory corruptions, resulting in a thread crash on an affected device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zyxel.com/global/en/suppor
CVE ID: CVE-2024-38269 State: PUBLISHED Published: 2024-09-24T01:38:14.149Z Last Updated: 2024-09-24T13:43:24.309Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: Zyxel Products: VMG8825-T50K firmware Problem Types: CWE-119 Description: An improper restriction of operations within the bounds of a memory buffer in the USB file-sharing handler of the Zyxel VMG8825-T50K firmware versions through 5.50(ABOM.8)C0 could allow an authenticated attacker with administrator privileges to cause potential memory corruptions, resulting in a thread crash on an affected device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zyxel.com/global/en/
on an affected device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-post-authentication-memory-corruption-vulnerabilities-in-some-dsl-ethernet-cpe-fiber-ont-wifi-extender-and-security-router-versions-09-24-2024
CVE ID: CVE-2024-38270 State: PUBLISHED Published: 2024-09-10T01:20:09.147Z Last Updated: 2024-09-10T15:15:34.477Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Zyxel Products: GS1900-10HP firmware Problem Types: CWE-331 Description: An insufficient entropy vulnerability caused by the improper use of a randomness function with low entropy for web authentication tokens generation exists in the Zyxel GS1900-10HP firmware version V2.80(AAZI.0)C0. This vulnerability could allow a LAN-based attacker a slight chance to gain a valid session token if multiple authenticated sessions are alive. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https:/
n if multiple authenticated sessions are alive. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-insufficient-entropy-vulnerability-for-web-authentication-tokens-generation-in-gs1900-series-switches-09-10-2024
CVE ID: CVE-2024-38271 State: PUBLISHED Published: 2024-06-26T15:19:13.955Z Last Updated: 2024-08-02T04:04:25.103Z Vendors: Google Products: Nearby Problem Types: CWE-404 Description: There exists a vulnerability in Quick Share/Nearby, where an attacker can force a victim to stay connected to a temporary hotspot created for the sharing. As part of the sequence of packets in a Quick Share connection over Bluetooth, the attacker forces the victim to connect to the attacker’s WiFi network and then sends an OfflineFrame that crashes Quick Share. This makes the Wifi connection to the attacker’s network last, instead of returning to the old network when the Quick Share session completes, allowing
o the attacker’s network last, instead of returning to the old network when the Quick Share session completes, allowing the attacker to be a MiTM. We recommend upgrading to version 1.0.1724.0 of Quick Share or above Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/google/nearby/pull/2433 - https://github.com/google/nearby/pull/2435 - https://github.com/google/nearby/pull/2589 - https://github.com/google/nearby/pull/2402
CVE ID: CVE-2024-38272 State: PUBLISHED Published: 2024-06-26T15:19:31.362Z Last Updated: 2024-08-02T04:04:25.233Z Vendors: Google Products: Nearby Problem Types: CWE-294 Description: There exists a vulnerability in Quick Share/Nearby, where an attacker can bypass the accept file dialog on Quick Share Windows. Normally in Quick Share Windows app we can't send a file without the user accept from the receiving device if the visibility is set to everyone mode or contacts mode. We recommend upgrading to version 1.0.1724.0 of Quick Share or above Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/google/nearby/pull/2589 - https://github.co
ADP Vulnrichment: - CVE Program Container: References: - https://github.com/google/nearby/pull/2589 - https://github.com/google/nearby/pull/2402
CVE ID: CVE-2024-38273 State: PUBLISHED Published: 2024-06-18T19:49:02.639Z Last Updated: 2025-02-13T17:53:01.350Z Vendors: Moodle Products: Moodle Problem Types: CWE-284 Description: Insufficient capability checks meant it was possible for users to gain access to BigBlueButton join URLs they did not have permission to access. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://moodle.org/mod/forum/discuss.php?d=459498 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GHTIX55J4Q4LEOMLNEA4OZSWVEENQX7E/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/F7A
MLNEA4OZSWVEENQX7E/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/F7AZYR7EXV6E5SQE2GYTNQE3NOENJCQ6/
CVE ID: CVE-2024-38274 State: PUBLISHED Published: 2024-06-18T19:49:15.739Z Last Updated: 2025-02-13T17:53:02.117Z Vendors: Moodle Products: Moodle Problem Types: CWE-79 Description: Insufficient escaping of calendar event titles resulted in a stored XSS risk in the event deletion prompt. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://moodle.org/mod/forum/discuss.php?d=459499 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GHTIX55J4Q4LEOMLNEA4OZSWVEENQX7E/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/F7AZYR7EXV6E5SQE2GYTNQE3NOENJCQ6/
CVE ID: CVE-2024-38275 State: PUBLISHED Published: 2024-06-18T19:49:26.986Z Last Updated: 2024-08-02T04:04:25.068Z Vendors: Moodle Products: Moodle Problem Types: CWE-226 Description: The cURL wrapper in Moodle retained the original request headers when following redirects, so HTTP authorization header information could be unintentionally sent in requests to redirect URLs. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://moodle.org/mod/forum/discuss.php?d=459500
CVE ID: CVE-2024-38276 State: PUBLISHED Published: 2024-06-18T19:49:40.339Z Last Updated: 2025-03-26T13:51:51.231Z Vendors: Moodle Products: Moodle Problem Types: CWE-352 Description: Incorrect CSRF token checks resulted in multiple CSRF risks. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://moodle.org/mod/forum/discuss.php?d=459501 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GHTIX55J4Q4LEOMLNEA4OZSWVEENQX7E/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/F7AZYR7EXV6E5SQE2GYTNQE3NOENJCQ6/
CVE ID: CVE-2024-38277 State: PUBLISHED Published: 2024-06-18T19:49:52.092Z Last Updated: 2025-02-13T17:53:03.298Z Vendors: Moodle Products: Moodle Problem Types: CWE-324 Description: A unique key should be generated for a user's QR login key and their auto-login key, so the same key cannot be used interchangeably between the two. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://moodle.org/mod/forum/discuss.php?d=459502 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GHTIX55J4Q4LEOMLNEA4OZSWVEENQX7E/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message
4LEOMLNEA4OZSWVEENQX7E/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/F7AZYR7EXV6E5SQE2GYTNQE3NOENJCQ6/