Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-50346 State: PUBLISHED Published: 2024-11-04T23:13:13.768Z Last Updated: 2024-11-05T16:43:45.147Z Vendors: taoso Products: webfeed Problem Types: CWE-79 Description: WebFeed is a lightweight web feed reader extension for Firefox/Chrome. Multiple HTML injection vulnerabilities in WebFeed can lead to CSRF and UI spoofing attacks. A remote attacker can provide malicious RSS feeds and attract the victim user to visit it using WebFeed. The attacker can then inject malicious HTML into the extension page and fool the victim into sending out HTTP requests to arbitrary sites with the victim's credentials. Users are vulnerable to CSRF attacks when visiting malicious RSS feeds via WebF
ary sites with the victim's credentials. Users are vulnerable to CSRF attacks when visiting malicious RSS feeds via WebFeed. Unwanted actions could be executed on the user's behalf on arbitrary websites. This issue has been addressed in release version 0.9.2. All users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/taoso/webfeed/security/advisories/GHSA-mrc7-2q3w-48j8 - https://github.com/taoso/webfeed/commit/a2d1c1c3a98f30e0bd7a1bbcb746fae484985e6d
CVE ID: CVE-2024-50347 State: PUBLISHED Published: 2024-10-31T17:56:41.503Z Last Updated: 2024-10-31T19:46:33.780Z Vendors: laravel Products: reverb Problem Types: CWE-347 Description: Laravel Reverb provides a real-time WebSocket communication backend for Laravel applications. Prior to 1.4.0, there is an issue where verification signatures for requests sent to Reverb's Pusher-compatible API were not being verified. This API is used in scenarios such as broadcasting a message from a backend service or for obtaining statistical information (such as number of connections) about a given channel. This issue only affects the Pusher-compatible API endpoints and not the WebSocket connections themse
ut a given channel. This issue only affects the Pusher-compatible API endpoints and not the WebSocket connections themselves. In order to exploit this vulnerability, the application ID which, should never be exposed, would need to be known by an attacker. This vulnerability is fixed in 1.4.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/laravel/reverb/security/advisories/GHSA-pfrr-xvrf-pxjx - https://github.com/laravel/reverb/pull/252 - https://github.com/laravel/reverb/commit/73cc140d76e803b151fc2dd2e4eb3eb784a82ee2 - https://github.com/laravel/reverb/releases/tag/v1.4.0
CVE ID: CVE-2024-50348 State: PUBLISHED Published: 2024-10-29T22:25:19.138Z Last Updated: 2024-10-30T13:13:20.085Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: instantsoft Products: icms2 Problem Types: CWE-79 Description: InstantCMS is a free and open source content management system. In photo upload function in the photo album page there is no input validation taking place. Due to this attackers are able to inject the XSS (Cross Site Scripting) payload and execute. This vulnerability is fixed in 2.16.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/instantsoft/icms2/security/advisories/GHSA-f6cf-jg84-fw29 - https://
ADP Vulnrichment: References: - https://github.com/instantsoft/icms2/security/advisories/GHSA-f6cf-jg84-fw29 - https://github.com/instantsoft/icms2/commit/e02de2fa1850bb40c9b2050b9256c838a0ea7aa3
CVE ID: CVE-2024-50349 State: PUBLISHED Published: 2025-01-14T18:43:42.620Z Last Updated: 2025-11-03T20:45:13.649Z Vendors: git Products: git Problem Types: CWE-116, CWE-147, CWE-150 Description: Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When Git asks for credentials via a terminal prompt (i.e. without using any credential helper), it prints out the host name for which the user is expected to provide a username and/or a password. At this stage, any URL-encoded parts have been decoded already, and are printed verbatim. This allows attackers to craft URLs that contain AN
L-encoded parts have been decoded already, and are printed verbatim. This allows attackers to craft URLs that contain ANSI escape sequences that the terminal interpret to confuse users e.g. into providing passwords for trusted Git hosting sites when in fact they are then sent to untrusted sites that are under the attacker's control. This issue has been patch via commits `7725b81` and `c903985` which are included in release versions v2.48.1, v2.47.2, v2.46.3, v2.45.3, v2.44.3, v2.43.6, v2.42.4, v2.41.3, and v2.40.4. Users are advised to upgrade. Users unable to upgrade should avoid cloning from untrusted URLs, especially recursive clones. Additional Analyst Notes: - CISA ADP Vulnrichment: - C
d avoid cloning from untrusted URLs, especially recursive clones. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/git/git/security/advisories/GHSA-hmg8-h7qf-7cxr - https://github.com/git/git/commit/7725b8100ffbbff2750ee4d61a0fcc1f53a086e8 - https://github.com/git/git/commit/c903985bf7e772e2d08275c1a95c8a55ab011577
CVE ID: CVE-2024-50350 State: PUBLISHED Published: 2024-11-15T15:30:14.935Z Last Updated: 2024-11-15T16:46:09.054Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: librenms Products: librenms Problem Types: CWE-79 Description: LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the "Port Settings" page allows authenticated users to inject arbitrary JavaScript through the "name" parameter when creating a new Port Group. This vulnerability results in the execution of malicious code when the "Port Settings" page is visited after the affected Port Group is added to a device, potentially
malicious code when the "Port Settings" page is visited after the affected Port Group is added to a device, potentially compromising user sessions and allowing unauthorized actions. This vulnerability is fixed in 24.10.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/librenms/librenms/security/advisories/GHSA-xh4g-c9p6-5jxg - https://github.com/librenms/librenms/commit/82a744bfe29017b8b58b5752ab9e1b335bedf0a0
CVE ID: CVE-2024-50351 State: PUBLISHED Published: 2024-11-15T15:34:42.697Z Last Updated: 2024-11-15T17:20:43.440Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: librenms Products: librenms Problem Types: CWE-79 Description: LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Reflected Cross-Site Scripting (XSS) vulnerability in the "section" parameter of the "logs" tab of a device allows attackers to inject arbitrary JavaScript. This vulnerability results in the execution of malicious code when a user accesses the page with a malicious "section" parameter, potentially compromising their session and enabling unauthorized actions. T
e page with a malicious "section" parameter, potentially compromising their session and enabling unauthorized actions. The issue arises from a lack of sanitization in the "report_this()" function. This vulnerability is fixed in 24.10.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/librenms/librenms/security/advisories/GHSA-v7w9-63xh-6r3w - https://github.com/librenms/librenms/commit/6a14a9bd767c6e452e4df77a24126c3eeb93dcbf
CVE ID: CVE-2024-50352 State: PUBLISHED Published: 2024-11-15T15:40:02.084Z Last Updated: 2024-11-15T16:13:05.493Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: librenms Products: librenms Problem Types: CWE-79 Description: LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the "Services" section of the Device Overview page allows authenticated users to inject arbitrary JavaScript through the "name" parameter when adding a service to a device. This vulnerability could result in the execution of malicious code in the context of other users' sessions, potentially compromising their
could result in the execution of malicious code in the context of other users' sessions, potentially compromising their accounts and enabling unauthorized actions. This vulnerability is fixed in 24.10.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/librenms/librenms/security/advisories/GHSA-qr8f-5qqg-j3wg - https://github.com/librenms/librenms/commit/b4af778ca42c5839801f16ece53505bb7fa1e7bc
CVE ID: CVE-2024-50353 State: PUBLISHED Published: 2024-10-30T13:57:28.984Z Last Updated: 2024-10-30T14:16:19.670Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: IowaComputerGurus Products: aspnetcore.utilities.cloudstorage Problem Types: CWE-284 Description: ICG.AspNetCore.Utilities.CloudStorage is a collection of cloud storage utilities to assist with the management of files for cloud upload. Users of this library that set a duration for a SAS Uri with a value other than 1 hour may have generated a URL with a duration that is longer, or shorter than desired. Users not implemented SAS Uri's are unaffected. This issue was resolved in version 8.0.0 of the li
shorter than desired. Users not implemented SAS Uri's are unaffected. This issue was resolved in version 8.0.0 of the library. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/IowaComputerGurus/aspnetcore.utilities.cloudstorage/security/advisories/GHSA-24mc-gc52-47jv - https://github.com/IowaComputerGurus/aspnetcore.utilities.cloudstorage/commit/8ea534481181a063175f457082662fdcad9a41ff
CVE ID: CVE-2024-50354 State: PUBLISHED Published: 2024-10-31T15:59:30.063Z Last Updated: 2024-10-31T16:53:21.298Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Consensys Products: gnark Problem Types: CWE-400 Description: gnark is a fast zk-SNARK library that offers a high-level API to design circuits. In gnark 0.11.0 and earlier, deserialization of Groth16 verification keys allocate excessive memory, consuming a lot of resources and triggering a crash with the error fatal error: runtime: out of memory. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Consensys/gnark/security/advisories/GHSA-cph5-3pgr-c82g - https://gith
DP Vulnrichment: References: - https://github.com/Consensys/gnark/security/advisories/GHSA-cph5-3pgr-c82g - https://github.com/Consensys/gnark/pull/1307 - https://github.com/Consensys/gnark/commit/47ae846339add2bdf9983e499342bfdfe195191d
CVE ID: CVE-2024-50355 State: PUBLISHED Published: 2024-11-15T15:41:48.260Z Last Updated: 2024-11-15T16:07:05.229Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: librenms Products: librenms Problem Types: CWE-79 Description: LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. User with Admin role can edit the Display Name of a device, the application did not properly sanitize the user input in the device Display Name, if java script code is inside the name of the device Display Name, its can be trigger from different sources. This vulnerability is fixed in 24.10.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http
t sources. This vulnerability is fixed in 24.10.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/librenms/librenms/security/advisories/GHSA-4m5r-w2rq-q54q - https://github.com/librenms/librenms/commit/bb4731419b592867bf974dde525e536606a52976
CVE ID: CVE-2024-50356 State: PUBLISHED Published: 2024-10-31T18:02:42.440Z Last Updated: 2024-11-01T13:51:00.632Z Severity: NONE (CVSS N/A CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N) Vendors: frappe Products: press Problem Types: CWE-640 Description: Press, a Frappe custom app that runs Frappe Cloud, manages infrastructure, subscription, marketplace, and software-as-a-service (SaaS). The password could be reset by anyone who have access to the mail inbox circumventing the 2FA. Even though they wouldn't be able to login by bypassing the 2FA. Only users who have enabled 2FA are affected. Commit ba0007c28ac814260f836849bc07d29beea7deb6 patches this bug. Additional Analyst Notes: - CISA ADP V
A are affected. Commit ba0007c28ac814260f836849bc07d29beea7deb6 patches this bug. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/frappe/press/security/advisories/GHSA-g7mf-rm73-r7g9 - https://github.com/frappe/press/commit/ba0007c28ac814260f836849bc07d29beea7deb6
CVE ID: CVE-2024-50357 State: PUBLISHED Published: 2024-11-29T09:06:56.251Z Last Updated: 2024-12-02T18:15:27.594Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Century Systems Co., Ltd. Products: FutureNet NXR-G110 series, FutureNet NXR-G060 series, FutureNet NXR-G050 series Problem Types: CWE-684 Description: FutureNet NXR series routers provided by Century Systems Co., Ltd. have REST-APIs, which are configured as disabled in the initial (factory default) configuration. But, REST-APIs are unexpectedly enabled when the affected product is powered up, provided either http-server (GUI) or Web authentication is enabled. The factory default configuration ma
is powered up, provided either http-server (GUI) or Web authentication is enabled. The factory default configuration makes http-server (GUI) enabled, which means REST-APIs are also enabled. The username and the password for REST-APIs are configured in the factory default configuration. As a result, an attacker may obtain and/or alter the affected product's settings via REST-APIs. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.centurysys.co.jp/backnumber/nxr_common/20241031-01.html - https://jvn.jp/en/vu/JVNVU95001899/
CVE ID: CVE-2024-50358 State: PUBLISHED Published: 2024-11-26T10:51:50.451Z Last Updated: 2024-11-26T14:19:27.283Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Advantech Products: EKI-6333AC-2G, EKI-6333AC-2GD, EKI-6333AC-1GPO Problem Types: CWE-15 Description: A CWE-15 "External Control of System or Configuration Setting" was discovered affecting the following devices manufactured by Advantech: EKI-6333AC-2G (<= 1.6.3), EKI-6333AC-2GD (<= v1.6.3) and EKI-6333AC-1GPO (<= v1.2.1). The vulnerability can be exploited by authenticated users by restoring a tampered configuration backup. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www
restoring a tampered configuration backup. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2024-50358
CVE ID: CVE-2024-50359 State: PUBLISHED Published: 2024-11-26T10:53:20.791Z Last Updated: 2024-11-26T14:19:27.111Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Advantech Products: EKI-6333AC-2G, EKI-6333AC-2GD, EKI-6333AC-1GPO Problem Types: CWE-78 Description: A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactured by Advantech: EKI-6333AC-2G (<= 1.6.3), EKI-6333AC-2GD (<= v1.6.3) and EKI-6333AC-1GPO (<= v1.2.1). The source of the vulnerability relies on multiple parameters belonging to the "scan_ap" API which are not properly sanitized before being co
nerability relies on multiple parameters belonging to the "scan_ap" API which are not properly sanitized before being concatenated to OS level commands. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2024-50359
CVE ID: CVE-2024-50360 State: PUBLISHED Published: 2024-11-26T10:53:33.887Z Last Updated: 2024-11-26T14:19:26.962Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Advantech Products: EKI-6333AC-2G, EKI-6333AC-2GD, EKI-6333AC-1GPO Problem Types: CWE-78 Description: A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactured by Advantech: EKI-6333AC-2G (<= 1.6.3), EKI-6333AC-2GD (<= v1.6.3) and EKI-6333AC-1GPO (<= v1.2.1). The source of the vulnerability relies on multiple parameters belonging to the "snmp_apply" API which are not properly sanitized before being
nerability relies on multiple parameters belonging to the "snmp_apply" API which are not properly sanitized before being concatenated to OS level commands. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2024-50360
CVE ID: CVE-2024-50361 State: PUBLISHED Published: 2024-11-26T10:53:51.367Z Last Updated: 2024-11-26T14:47:24.692Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Advantech Products: EKI-6333AC-2G, EKI-6333AC-2GD, EKI-6333AC-1GPO Problem Types: CWE-78 Description: A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactured by Advantech: EKI-6333AC-2G (<= 1.6.3), EKI-6333AC-2GD (<= v1.6.3) and EKI-6333AC-1GPO (<= v1.2.1). The source of the vulnerability relies on multiple parameters belonging to the "certificate_file_remove" API which are not properly sanitized
nerability relies on multiple parameters belonging to the "certificate_file_remove" API which are not properly sanitized before being concatenated to OS level commands. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2024-50361
CVE ID: CVE-2024-50362 State: PUBLISHED Published: 2024-11-26T10:54:03.960Z Last Updated: 2024-11-26T14:47:41.862Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Advantech Products: EKI-6333AC-2G, EKI-6333AC-2GD, EKI-6333AC-1GPO Problem Types: CWE-78 Description: A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactured by Advantech: EKI-6333AC-2G (<= 1.6.3), EKI-6333AC-2GD (<= v1.6.3) and EKI-6333AC-1GPO (<= v1.2.1). The source of the vulnerability relies on multiple parameters belonging to the "connection_profile_apply" API which are not properly sanitize
nerability relies on multiple parameters belonging to the "connection_profile_apply" API which are not properly sanitized before being concatenated to OS level commands. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2024-50362
CVE ID: CVE-2024-50363 State: PUBLISHED Published: 2024-11-26T10:54:20.523Z Last Updated: 2024-11-26T14:46:59.844Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Advantech Products: EKI-6333AC-2G, EKI-6333AC-2GD, EKI-6333AC-1GPO Problem Types: CWE-78 Description: A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactured by Advantech: EKI-6333AC-2G (<= 1.6.3), EKI-6333AC-2GD (<= v1.6.3) and EKI-6333AC-1GPO (<= v1.2.1). The source of the vulnerability relies on multiple parameters belonging to the "mp_apply" API which are not properly sanitized before being c
nerability relies on multiple parameters belonging to the "mp_apply" API which are not properly sanitized before being concatenated to OS level commands. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2024-50363
CVE ID: CVE-2024-50364 State: PUBLISHED Published: 2024-11-26T10:54:32.798Z Last Updated: 2024-11-26T14:46:34.267Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Advantech Products: EKI-6333AC-2G, EKI-6333AC-2GD, EKI-6333AC-1GPO Problem Types: CWE-78 Description: A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactured by Advantech: EKI-6333AC-2G (<= 1.6.3), EKI-6333AC-2GD (<= v1.6.3) and EKI-6333AC-1GPO (<= v1.2.1). The source of the vulnerability relies on multiple parameters belonging to the "export_log" API which are not properly sanitized before being
nerability relies on multiple parameters belonging to the "export_log" API which are not properly sanitized before being concatenated to OS level commands. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2024-50364
CVE ID: CVE-2024-50365 State: PUBLISHED Published: 2024-11-26T10:54:43.728Z Last Updated: 2024-11-26T14:46:21.281Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Advantech Products: EKI-6333AC-2G, EKI-6333AC-2GD, EKI-6333AC-1GPO Problem Types: CWE-78 Description: A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactured by Advantech: EKI-6333AC-2G (<= 1.6.3), EKI-6333AC-2GD (<= v1.6.3) and EKI-6333AC-1GPO (<= v1.2.1). The source of the vulnerability relies on multiple parameters belonging to the "lan_apply" API which are not properly sanitized before being
nerability relies on multiple parameters belonging to the "lan_apply" API which are not properly sanitized before being concatenated to OS level commands. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2024-50365
CVE ID: CVE-2024-50366 State: PUBLISHED Published: 2024-11-26T10:54:55.541Z Last Updated: 2024-11-26T14:19:26.822Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Advantech Products: EKI-6333AC-2G, EKI-6333AC-2GD, EKI-6333AC-1GPO Problem Types: CWE-78 Description: A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactured by Advantech: EKI-6333AC-2G (<= 1.6.3), EKI-6333AC-2GD (<= v1.6.3) and EKI-6333AC-1GPO (<= v1.2.1). The source of the vulnerability relies on multiple parameters belonging to the "applications_apply" API which are not properly sanitized befo
nerability relies on multiple parameters belonging to the "applications_apply" API which are not properly sanitized before being concatenated to OS level commands. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2024-50366
CVE ID: CVE-2024-50367 State: PUBLISHED Published: 2024-11-26T10:55:06.118Z Last Updated: 2024-11-26T15:37:10.967Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Advantech Products: EKI-6333AC-2G, EKI-6333AC-2GD, EKI-6333AC-1GPO Problem Types: CWE-78 Description: A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactured by Advantech: EKI-6333AC-2G (<= 1.6.3), EKI-6333AC-2GD (<= v1.6.3) and EKI-6333AC-1GPO (<= v1.2.1). The source of the vulnerability relies on multiple parameters belonging to the "sta_log_htm" API which are not properly sanitized before bein
nerability relies on multiple parameters belonging to the "sta_log_htm" API which are not properly sanitized before being concatenated to OS level commands. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2024-50367