Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
rise 1.9.2, 1.8.7, and 1.7.15. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://discuss.hashicorp.com/t/hcsec-2024-27-nomad-vulnerable-to-cross-namespace-volume-creation-abusing-csi-write-permission
CVE ID: CVE-2024-10976 State: PUBLISHED Published: 2024-11-14T13:00:01.930Z Last Updated: 2025-11-03T21:51:36.955Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: n/a Products: PostgreSQL Problem Types: CWE-1250 Description: Incomplete tracking in PostgreSQL of tables with row security allows a reused query to view or change different rows from those intended. CVE-2023-2455 and CVE-2016-2193 fixed most interaction between row security and user ID changes. They missed cases where a subquery, WITH query, security invoker view, or SQL-language function references a table with a row-level security policy. This has the same consequences as the two earlier CVEs. T
function references a table with a row-level security policy. This has the same consequences as the two earlier CVEs. That is to say, it leads to potentially incorrect policies being applied in cases where role-specific policies are used and a given query is planned under one role and then executed under other roles. This scenario can happen under security definer functions or when a common user and query is planned initially and then re-used across multiple SET ROLEs. Applying an incorrect policy may permit a user to complete otherwise-forbidden reads and modifications. This affects only databases that have used CREATE POLICY to define a row security policy. An attacker must tailor an atta
his affects only databases that have used CREATE POLICY to define a row security policy. An attacker must tailor an attack to a particular application's pattern of query plan reuse, user ID changes, and role-specific row security policies. Versions before PostgreSQL 17.1, 16.5, 15.9, 14.14, 13.17, and 12.21 are affected. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.postgresql.org/support/security/CVE-2024-10976/
CVE ID: CVE-2024-10977 State: PUBLISHED Published: 2024-11-14T13:00:05.715Z Last Updated: 2025-11-03T21:51:38.414Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: n/a Products: PostgreSQL Problem Types: CWE-348 Description: Client use of server error message in PostgreSQL allows a server not trusted under current SSL or GSS settings to furnish arbitrary non-NUL bytes to the libpq application. For example, a man-in-the-middle attacker could send a long error message that a human or screen-scraper user of psql mistakes for valid query results. This is probably not a concern for clients where the user interface unambiguously indicates the boundary between one erro
his is probably not a concern for clients where the user interface unambiguously indicates the boundary between one error message and other text. Versions before PostgreSQL 17.1, 16.5, 15.9, 14.14, 13.17, and 12.21 are affected. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.postgresql.org/support/security/CVE-2024-10977/
CVE ID: CVE-2024-10978 State: PUBLISHED Published: 2024-11-14T13:00:07.398Z Last Updated: 2025-11-03T21:51:39.867Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: n/a Products: PostgreSQL Problem Types: CWE-266 Description: Incorrect privilege assignment in PostgreSQL allows a less-privileged application user to view or change different rows from those intended. An attack requires the application to use SET ROLE, SET SESSION AUTHORIZATION, or an equivalent feature. The problem arises when an application query uses parameters from the attacker or conveys query results to the attacker. If that query reacts to current_setting('role') or the current user ID, it
er or conveys query results to the attacker. If that query reacts to current_setting('role') or the current user ID, it may modify or return data as though the session had not used SET ROLE or SET SESSION AUTHORIZATION. The attacker does not control which incorrect user ID applies. Query text from less-privileged sources is not a concern here, because SET ROLE and SET SESSION AUTHORIZATION are not sandboxes for unvetted queries. Versions before PostgreSQL 17.1, 16.5, 15.9, 14.14, 13.17, and 12.21 are affected. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.postgresql.org/support/security/CVE-2024-10978/
CVE ID: CVE-2024-10979 State: PUBLISHED Published: 2024-11-14T13:00:08.586Z Last Updated: 2025-11-03T21:51:41.330Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: n/a Products: PostgreSQL Problem Types: CWE-15 Description: Incorrect control of environment variables in PostgreSQL PL/Perl allows an unprivileged database user to change sensitive process environment variables (e.g. PATH). That often suffices to enable arbitrary code execution, even if the attacker lacks a database server operating system user. Versions before PostgreSQL 17.1, 16.5, 15.9, 14.14, 13.17, and 12.21 are affected. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Containe
5, 15.9, 14.14, 13.17, and 12.21 are affected. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.postgresql.org/support/security/CVE-2024-10979/
CVE ID: CVE-2024-10980 State: PUBLISHED Published: 2024-11-29T06:00:07.501Z Last Updated: 2024-11-29T14:54:11.431Z Vendors: Unknown Products: Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows) Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows) WordPress plugin before 5.10.3 does not validate and escape some of its Cookie Consent block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. Ad
is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/915daad8-d14c-4457-a3a0-aa21744f4ae0/
CVE ID: CVE-2024-10986 State: PUBLISHED Published: 2025-03-20T10:10:55.368Z Last Updated: 2025-10-15T12:50:15.584Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: binary-husky Products: binary-husky/gpt_academic Problem Types: CWE-59 Description: GPT Academic version 3.83 is vulnerable to a Local File Read (LFI) vulnerability through its HotReload function. This function can download and extract tar.gz files from arxiv.org. Despite implementing protections against path traversal, the application overlooks the Tarslip triggered by symlinks. This oversight allows attackers to read arbitrary local files from the victim server. Additional Analyst Notes: - CISA ADP
is oversight allows attackers to read arbitrary local files from the victim server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/db2167f5-f17f-491d-aeec-69ba55bf6427
CVE ID: CVE-2024-10987 State: PUBLISHED Published: 2024-11-08T03:31:04.074Z Last Updated: 2024-11-08T15:05:50.651Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: code-projects Products: E-Health Care System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in code-projects E-Health Care System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /Doctor/user_appointment.php. The manipulation of the argument schedule_id/schedule_date/schedule_day/start_time/end_time/booking leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additiona
injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.283453 - https://vuldb.com/?ctiid.283453 - https://vuldb.com/?submit.437351 - https://github.com/qqqbalabala/cve/blob/main/sql20.md - https://code-projects.org/
CVE ID: CVE-2024-10988 State: PUBLISHED Published: 2024-11-08T04:00:04.829Z Last Updated: 2024-11-08T15:04:20.338Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: code-projects Products: E-Health Care System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in code-projects E-Health Care System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /Doctor/doctor_login.php. The manipulation of the argument email leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. Additional Analyst Notes: - CISA ADP Vu
losed to the public and may be used. Other parameters might be affected as well. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.283454 - https://vuldb.com/?ctiid.283454 - https://vuldb.com/?submit.438286 - https://github.com/20241018/cve/blob/main/sql.md - https://code-projects.org/
CVE ID: CVE-2024-10989 State: PUBLISHED Published: 2024-11-08T04:00:07.132Z Last Updated: 2024-11-08T15:01:02.649Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: code-projects Products: E-Health Care System Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical has been found in code-projects E-Health Care System 1.0. This affects an unknown part of the file /Admin/detail.php. The manipulation of the argument s_id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The initial researcher advisory confuses the vulnerability class of this issue. Additional Analyst Notes: -
may be used. The initial researcher advisory confuses the vulnerability class of this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.283455 - https://vuldb.com/?ctiid.283455 - https://vuldb.com/?submit.438421 - https://github.com/miaoyum/cve/blob/main/sql21.md - https://code-projects.org/
CVE ID: CVE-2024-10990 State: PUBLISHED Published: 2024-11-08T04:31:05.695Z Last Updated: 2024-11-08T14:58:58.134Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Online Veterinary Appointment System Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical was found in SourceCodester Online Veterinary Appointment System 1.0. This vulnerability affects unknown code of the file /admin/services/view_service.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: -
ploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.283456 - https://vuldb.com/?ctiid.283456 - https://vuldb.com/?submit.437383 - https://github.com/AspirePig/Cve_report/blob/main/online-veterinary-appointment-system/SQLi-1.md - https://www.sourcecodester.com/
CVE ID: CVE-2024-10991 State: PUBLISHED Published: 2024-11-08T05:00:06.625Z Last Updated: 2024-11-08T14:52:34.168Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Codezips Products: Hospital Appointment System Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, has been found in Codezips Hospital Appointment System 1.0. This issue affects some unknown processing of the file /editBranchResult.php. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?i
sed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.283457 - https://vuldb.com/?ctiid.283457 - https://vuldb.com/?submit.437393 - https://github.com/ppp-src/CVE/issues/30
CVE ID: CVE-2024-10993 State: PUBLISHED Published: 2024-11-08T05:31:04.606Z Last Updated: 2024-11-08T14:48:47.727Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Codezips Products: Online Institute Management System Problem Types: CWE-434, CWE-284 Description: A vulnerability, which was classified as critical, was found in Codezips Online Institute Management System 1.0. Affected is an unknown function of the file /manage_website.php. The manipulation of the argument website_image leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References:
exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.283458 - https://vuldb.com/?ctiid.283458 - https://vuldb.com/?submit.437409 - https://github.com/NG0324/CVE/issues/2
CVE ID: CVE-2024-10994 State: PUBLISHED Published: 2024-11-08T06:00:07.894Z Last Updated: 2024-11-08T14:32:24.056Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Codezips Products: Online Institute Management System Problem Types: CWE-434, CWE-284 Description: A vulnerability has been found in Codezips Online Institute Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /edit_user.php. The manipulation of the argument image leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: Reference
e exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.283459 - https://vuldb.com/?ctiid.283459 - https://vuldb.com/?submit.438412 - https://github.com/Hacker0xone/CVE/issues/1
CVE ID: CVE-2024-10995 State: PUBLISHED Published: 2024-11-08T06:31:04.422Z Last Updated: 2024-11-08T14:30:54.537Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Codezips Products: Hospital Appointment System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in Codezips Hospital Appointment System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /removeDoctorResult.php. The manipulation of the argument Name leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?i
sed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.283460 - https://vuldb.com/?ctiid.283460 - https://vuldb.com/?submit.438428 - https://github.com/Hacker0xone/CVE/issues/2
CVE ID: CVE-2024-10996 State: PUBLISHED Published: 2024-11-08T06:31:06.264Z Last Updated: 2024-11-08T14:29:26.188Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: 1000 Projects Products: Bookstore Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in 1000 Projects Bookstore Management System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/process_category_edit.php. The manipulation of the argument cat leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https:
as been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.283461 - https://vuldb.com/?ctiid.283461 - https://vuldb.com/?submit.438105 - https://github.com/ppp-src/CVE/issues/32
CVE ID: CVE-2024-10997 State: PUBLISHED Published: 2024-11-08T07:00:10.445Z Last Updated: 2024-11-08T14:27:34.067Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: 1000 Projects Products: Bookstore Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in 1000 Projects Bookstore Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /book_list.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.2834
the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.283462 - https://vuldb.com/?ctiid.283462 - https://vuldb.com/?submit.438146 - https://github.com/Sy0ung-cmd/CVE/blob/main/vendors/1000projects/bookstore-management-system/SQLi-1.md
CVE ID: CVE-2024-10998 State: PUBLISHED Published: 2024-11-08T07:31:04.013Z Last Updated: 2024-11-08T14:26:21.571Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: 1000 Projects Products: Bookstore Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in 1000 Projects Bookstore Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin/process_category_add.php. The manipulation of the argument cat leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://
been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.283463 - https://vuldb.com/?ctiid.283463 - https://vuldb.com/?submit.438409 - https://github.com/090913/CVE/issues/1
CVE ID: CVE-2024-10999 State: PUBLISHED Published: 2024-11-08T08:00:08.825Z Last Updated: 2024-11-08T14:24:05.711Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: CodeAstro Products: Real Estate Management System Problem Types: CWE-434, CWE-284 Description: A vulnerability classified as problematic has been found in CodeAstro Real Estate Management System 1.0. Affected is an unknown function of the file /aboutadd.php of the component About Us Page. The manipulation of the argument aimage leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: Refer
. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.283464 - https://vuldb.com/?ctiid.283464 - https://github.com/EmilGallajov/zero-day/blob/main/codeastro_real_estate_ms_authenticated_rce.md - https://codeastro.com/
CVE ID: CVE-2024-11000 State: PUBLISHED Published: 2024-11-08T08:00:10.354Z Last Updated: 2024-11-08T14:22:49.736Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: CodeAstro Products: Real Estate Management System Problem Types: CWE-434, CWE-284 Description: A vulnerability classified as problematic was found in CodeAstro Real Estate Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /aboutedit.php of the component About Us Page. The manipulation of the argument aimage leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnr
nched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.283465 - https://vuldb.com/?ctiid.283465 - https://vuldb.com/?submit.438603 - https://github.com/EmilGallajov/zero-day/blob/main/codeastro_real_estate_ms_authenticated_rce.md - https://codeastro.com/
CVE ID: CVE-2024-11002 State: PUBLISHED Published: 2024-11-26T06:43:44.633Z Last Updated: 2024-11-26T14:57:55.452Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: realmag777 Products: InPost Gallery Problem Types: CWE-94 Description: The The InPost Gallery plugin for WordPress is vulnerable to arbitrary shortcode execution via the inpost_gallery_get_shortcode_template AJAX action in all versions up to, and including, 2.1.4.2. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute
ng do_shortcode. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary shortcodes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5fbb2dcf-38b8-4ef1-bfea-bf5872cc7e37?source=cve - https://plugins.trac.wordpress.org/browser/inpost-gallery/trunk/index.php#L323 - https://wordpress.org/plugins/inpost-gallery/#developers - https://plugins.trac.wordpress.org/changeset/3192113/
CVE ID: CVE-2024-11003 State: PUBLISHED Published: 2024-11-19T17:36:36.682Z Last Updated: 2025-11-03T21:51:44.254Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: needrestart Products: needrestart Description: Qualys discovered that needrestart, before version 3.8, passes unsanitized data to a library (Modules::ScanDeps) which expects safe input. This could allow a local attacker to execute arbitrary shell commands. Please see the related CVE-2024-10224 in Modules::ScanDeps. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.cve.org/CVERecord?id=CVE-2024-11003 - https://github.com/liske/needrestart/commit/0f80
tainer: References: - https://www.cve.org/CVERecord?id=CVE-2024-11003 - https://github.com/liske/needrestart/commit/0f80a348883f72279a859ee655f58da34babefb0 - https://www.qualys.com/2024/11/19/needrestart/needrestart.txt - https://www.cve.org/CVERecord?id=CVE-2024-10224
CVE ID: CVE-2024-11004 State: PUBLISHED Published: 2024-11-12T16:09:19.437Z Last Updated: 2025-04-04T14:34:21.002Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Ivanti Products: Connect Secure, Policy Secure Problem Types: CWE-79 Description: Reflected XSS in Ivanti Connect Secure before version 22.7R2.1 and Ivanti Policy Secure before version 22.7R1.1 allows a remote unauthenticated attacker to obtain admin privileges. User interaction is required. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-ICS-Ivanti-Policy-Secure-IPS-Ivanti-Secure-Access-Client-ISAC-Multipl
/s/article/Security-Advisory-Ivanti-Connect-Secure-ICS-Ivanti-Policy-Secure-IPS-Ivanti-Secure-Access-Client-ISAC-Multiple-CVEs
CVE ID: CVE-2024-11005 State: PUBLISHED Published: 2024-11-12T16:07:45.350Z Last Updated: 2024-11-22T16:33:10.013Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Ivanti Products: Connect Secure, Policy Secure Problem Types: CWE-78 Description: Command injection in Ivanti Connect Secure before version 22.7R2.1 (Not Applicable to 9.1Rx) and Ivanti Policy Secure before version 22.7R1.1 (Not Applicable to 9.1Rx) allows a remote authenticated attacker with admin privileges to achieve remote code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-ICS-Ivanti-Poli
Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-ICS-Ivanti-Policy-Secure-IPS-Ivanti-Secure-Access-Client-ISAC-Multiple-CVEs