Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-45627 State: PUBLISHED Published: 2025-01-14T16:13:20.135Z Last Updated: 2025-01-14T17:19:09.863Z Vendors: Apache Software Foundation Products: Apache Linkis Metadata Query Service JDBC Problem Types: CWE-552 Description: In Apache Linkis <1.7.0, due to the lack of effective filtering of parameters, an attacker configuring malicious Mysql JDBC parameters in the DataSource Manager Module will allow the attacker to read arbitrary files from the Linkis server. Therefore, the parameters in the Mysql JDBC URL should be blacklisted. This attack requires the attacker to obtain an authorized account from Linkis before it can be carried out. Versions of Apache Linkis < 1.7.0 will be
ker to obtain an authorized account from Linkis before it can be carried out. Versions of Apache Linkis < 1.7.0 will be affected. We recommend users upgrade the version of Linkis to version 1.7.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/0zzx8lldwoqgzq98mg61hojgpvn76xsh
CVE ID: CVE-2024-45638 State: PUBLISHED Published: 2025-03-14T14:49:52.646Z Last Updated: 2025-09-01T01:05:22.574Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: QRadar EDR Problem Types: CWE-256 Description: IBM Security QRadar 3.12 EDR stores user credentials in plain text which can be read by a local privileged user. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7185938
CVE ID: CVE-2024-45640 State: PUBLISHED Published: 2025-01-07T12:22:04.843Z Last Updated: 2025-01-07T14:40:57.535Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: IBM Products: Security QRadar EDR Problem Types: CWE-497 Description: IBM Security ReaQta 3.12 returns sensitive information in an HTTP response that could be used in further attacks against the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7180313
CVE ID: CVE-2024-45641 State: PUBLISHED Published: 2025-05-20T15:27:45.402Z Last Updated: 2025-08-26T15:05:26.154Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: IBM Products: Security ReaQta EDR Problem Types: CWE-295 Description: IBM Security ReaQta EDR 3.12 could allow an attacker to perform unauthorized actions due to improper SSL certificate validation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7233972
CVE ID: CVE-2024-45642 State: PUBLISHED Published: 2024-11-14T12:04:31.126Z Last Updated: 2024-11-14T14:04:51.919Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: IBM Products: Security ReaQta Problem Types: CWE-942 Description: IBM Security ReaQta 3.12 is vulnerable to cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7172212
CVE ID: CVE-2024-45643 State: PUBLISHED Published: 2025-03-14T14:49:01.428Z Last Updated: 2025-09-01T01:05:04.266Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: QRadar EDR Problem Types: CWE-327 Description: IBM Security QRadar 3.12 EDR uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt sensitive credential information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7185938
CVE ID: CVE-2024-45644 State: PUBLISHED Published: 2025-03-19T11:16:42.624Z Last Updated: 2025-09-01T01:03:04.629Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L) Vendors: IBM Products: Security ReaQta Problem Types: CWE-434 Description: IBM Security ReaQta 3.12 allows a privileged user to upload or transfer files of dangerous types that can be automatically processed within the product's environment. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7186613
CVE ID: CVE-2024-45647 State: PUBLISHED Published: 2025-01-20T14:50:54.184Z Last Updated: 2025-01-21T20:08:31.459Z Severity: MEDIUM (CVSS 5.6 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: IBM Products: Security Verify Access, Security Verify Access Docker Problem Types: CWE-620 Description: IBM Security Verify Access 10.0.0 through 10.0.8 and IBM Security Verify Access Docker 10.0.0 through 10.0.8 could allow could an unverified user to change the password of an expired user without prior knowledge of that password. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7176212
CVE ID: CVE-2024-45650 State: PUBLISHED Published: 2025-01-31T15:07:24.198Z Last Updated: 2025-01-31T15:24:33.790Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: IBM Products: Security Verify Directory Problem Types: CWE-754 Description: IBM Security Verify Directory 10.0 through 10.0.3 is vulnerable to a denial of service when sending an LDAP extended operation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7182169
CVE ID: CVE-2024-45651 State: PUBLISHED Published: 2025-04-18T11:04:55.508Z Last Updated: 2025-09-01T00:41:10.652Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: IBM Products: Sterling Connect:Direct Web Services Problem Types: CWE-613 Description: IBM Sterling Connect:Direct Web Services 6.1.0, 6.2.0, and 6.3.0 does not invalidate session after a browser closure which could allow an authenticated user to impersonate another user on the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7231178
CVE ID: CVE-2024-45652 State: PUBLISHED Published: 2025-01-19T02:42:18.748Z Last Updated: 2025-01-21T20:28:47.429Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: Maximo Asset Management Problem Types: CWE-22 Description: IBM Maximo MXAPIASSET API 7.6.1.3 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7174820
CVE ID: CVE-2024-45653 State: PUBLISHED Published: 2025-01-19T02:39:30.681Z Last Updated: 2025-01-21T20:29:11.755Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: IBM Products: Sterling Connect:Direct Web Services Problem Types: CWE-201 Description: IBM Sterling Connect:Direct Web Services 6.0, 6.1, 6.2, and 6.3 could disclose sensitive IP address information to authenticated users in responses that could be used in further attacks against the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7174104
CVE ID: CVE-2024-45654 State: PUBLISHED Published: 2025-01-19T02:19:11.978Z Last Updated: 2025-01-27T21:06:49.624Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: IBM Products: Security ReaQta Problem Types: CWE-807 Description: IBM Security ReaQta 3.12 could allow an authenticated user to perform unauthorized actions due to reliance on untrusted inputs. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7175072
CVE ID: CVE-2024-45655 State: PUBLISHED Published: 2025-06-03T14:48:55.648Z Last Updated: 2025-08-24T11:59:21.665Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: IBM Products: Application Gateway Problem Types: CWE-732 Description: IBM Application Gateway 19.12 through 24.09 could allow a local privileged user to perform unauthorized actions due to incorrect permissions assignment. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7235378
CVE ID: CVE-2024-45656 State: PUBLISHED Published: 2024-10-29T00:37:16.004Z Last Updated: 2024-11-02T03:55:32.353Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: IBM Products: Flexible Service Processor Problem Types: CWE-798 Description: IBM Flexible Service Processor (FSP) FW860.00 through FW860.B3, FW950.00 through FW950.C0, FW1030.00 through FW1030.61, FW1050.00 through FW1050.21, and FW1060.00 through FW1060.10 has static credentials which may allow network users to gain service privileges to the FSP. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7174183
CVE ID: CVE-2024-45657 State: PUBLISHED Published: 2025-02-04T20:40:08.652Z Last Updated: 2025-02-22T20:58:11.171Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L) Vendors: IBM Products: Security Verify Access Appliance, Security Verify Access Container Problem Types: CWE-732 Description: IBM Security Verify Access Appliance and Container 10.0.0 through 10.0.8 could allow a local privileged user to perform unauthorized actions due to incorrect permissions assignment. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7182386
CVE ID: CVE-2024-45658 State: PUBLISHED Published: 2025-02-04T20:37:13.537Z Last Updated: 2025-02-22T20:58:47.025Z Severity: LOW (CVSS 2.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N) Vendors: IBM Products: Security Verify Access Appliance, Security Verify Access Container Problem Types: CWE-209 Description: IBM Security Verify Access Appliance and Container 10.0.0 through 10.0.8 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned. This information could be used in further attacks against the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7182386
CVE ID: CVE-2024-45659 State: PUBLISHED Published: 2025-02-04T17:34:12.764Z Last Updated: 2025-02-22T20:59:15.675Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: IBM Products: Security Verify Access Appliance, Security Verify Access Container Problem Types: CWE-209 Description: IBM Security Verify Access Appliance and Container 10.0.0 through 10.0.8 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned. This information could be used in further attacks against the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7182386
CVE ID: CVE-2024-45662 State: PUBLISHED Published: 2025-01-18T16:19:46.770Z Last Updated: 2025-01-21T20:43:58.480Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: IBM Products: Safer Payments Problem Types: CWE-770 Description: IBM Safer Payments 6.4.0.00 through 6.4.2.07, 6.5.0.00 through 6.5.0.05, and 6.6.0.00 through 6.6.0.03 could allow a remote attacker to cause a denial of service due to improper allocation of resources. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7173765
CVE ID: CVE-2024-45663 State: PUBLISHED Published: 2024-11-21T00:22:03.293Z Last Updated: 2024-12-20T13:06:44.324Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: IBM Products: Db2 for Linux, UNIX and Windows Problem Types: CWE 789 Uncontrolled Memory Allocation Description: IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1, 11.5, and 12.1 is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7175943
CVE ID: CVE-2024-45669 State: PUBLISHED Published: 2025-09-10T20:06:58.159Z Last Updated: 2025-09-10T20:12:03.371Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: IBM Products: Security Verify Information Queue Problem Types: CWE-770 Description: IBM Security Verify Information Queue 10.0.5, 10.0.6, 10.0.7, and 10.0.8 could allow a remote user to cause a denial of service due to improper handling of special characters that could lead to uncontrolled resource consumption. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7244514
CVE ID: CVE-2024-45670 State: PUBLISHED Published: 2024-11-14T11:50:02.851Z Last Updated: 2024-11-14T14:13:23.637Z Severity: MEDIUM (CVSS 5.6 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: IBM Products: Security SOAR Problem Types: CWE-640 Description: IBM Security SOAR 51.0.1.0 and earlier contains a mechanism for users to recover or change their passwords without knowing the original password, but the user account must be compromised prior to the weak recovery mechanism. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7172206
CVE ID: CVE-2024-45671 State: PUBLISHED Published: 2025-09-10T20:08:17.525Z Last Updated: 2025-09-10T20:12:30.423Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: Security Verify Information Queue Problem Types: CWE-327 Description: IBM Security Verify Information Queue 10.0.5, 10.0.6, 10.0.7, and 10.0.8 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7244514
CVE ID: CVE-2024-45672 State: PUBLISHED Published: 2025-01-23T17:31:58.939Z Last Updated: 2025-01-23T19:01:40.369Z Severity: MEDIUM (CVSS 6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H) Vendors: IBM Products: Security Verify Bridge Problem Types: CWE-471 Description: IBM Security Verify Bridge 1.0.0 through 1.0.15 could allow a local privileged user to overwrite files due to excessive privileges granted to the agent. which could also cause a denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7181370
CVE ID: CVE-2024-45673 State: PUBLISHED Published: 2025-02-21T16:45:51.122Z Last Updated: 2025-08-27T21:33:04.260Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: Security Verify Bridge Directory Sync Problem Types: CWE-260 Description: IBM Security Verify Bridge Directory Sync 1.0.1 through 1.0.12, IBM Security Verify Gateway for Windows Login 1.0.1 through 1.0.10, and IBM Security Verify Gateway for Radius 1.0.1 through 1.0.11 stores user credentials in configuration files which can be read by a local user. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7183801
CVE ID: CVE-2024-45674 State: PUBLISHED Published: 2025-02-21T23:29:17.020Z Last Updated: 2025-08-15T14:26:14.800Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: IBM Products: Security Verify Bridge Directory Sync Problem Types: CWE-532 Description: IBM Security Verify Bridge Directory Sync 1.0.1 through 1.0.12, IBM Security Verify Gateway for Windows Login 1.0.1 through 1.0.10, and IBM Security Verify Gateway for Radius 1.0.1 through 1.0.11 stores potentially sensitive information in log files that could be read by a local user. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7183801
CVE ID: CVE-2024-45676 State: PUBLISHED Published: 2024-12-03T17:08:51.441Z Last Updated: 2024-12-03T17:55:03.449Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: IBM Products: Cognos Controller Problem Types: CWE-351 Description: IBM Cognos Controller 11.0.0 and 11.0.1 could allow an authenticated user to upload insecure files, due to insufficient file type distinction. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7177220
CVE ID: CVE-2024-45678 State: PUBLISHED Published: 2024-09-03T00:00:00.000Z Last Updated: 2025-03-17T17:51:54.621Z Vendors: n/a Products: n/a Problem Types: n/a Description: Yubico YubiKey 5 Series devices with firmware before 5.7.0 and YubiHSM 2 devices with firmware before 2.4.0 allow an ECDSA secret-key extraction attack (that requires physical access and expensive equipment) in which an electromagnetic side channel is present because of a non-constant-time modular inversion for the Extended Euclidean Algorithm, aka the EUCLEAK issue. Other uses of an Infineon cryptographic library may also be affected. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.yubico.co
hic library may also be affected. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.yubico.com/support/security-advisories/ysa-2024-03/ - https://support.yubico.com/hc/en-us/articles/15705749884444 - https://ninjalab.io/eucleak/ - https://ninjalab.io/wp-content/uploads/2024/09/20240903_eucleak.pdf - https://news.ycombinator.com/item?id=41434500 - https://arstechnica.com/security/2024/09/yubikeys-are-vulnerable-to-cloning-attacks-thanks-to-newly-discovered-side-channel/
CVE ID: CVE-2024-45679 State: PUBLISHED Published: 2024-09-18T03:35:30.462Z Last Updated: 2024-09-18T15:27:31.758Z Vendors: Open Asset Import Library Products: Assimp Problem Types: Heap-based buffer overflow Description: Heap-based buffer overflow vulnerability in Assimp versions prior to 5.4.3 allows a local attacker to execute arbitrary code by importing a specially crafted file into the product. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/assimp/assimp/releases/tag/v5.4.3 - https://jvn.jp/en/jp/JVN42386607/
CVE ID: CVE-2024-45682 State: PUBLISHED Published: 2024-09-17T17:13:18.655Z Last Updated: 2024-09-17T20:07:31.307Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Millbeck Communications Products: Proroute H685t-w Problem Types: CWE-77 Description: There is a command injection vulnerability that may allow an attacker to inject malicious input on the device's operating system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-261-02
CVE ID: CVE-2024-45687 State: PUBLISHED Published: 2025-01-21T16:35:43.932Z Last Updated: 2025-02-12T20:41:21.565Z Vendors: Payara Platform Products: Payara Server, Payara Micro Problem Types: CWE-113 Description: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in Payara Platform Payara Server (Grizzly, REST Management Interface modules), Payara Platform Payara Micro (Grizzly modules) allows Manipulating State, Identity Spoofing.This issue affects Payara Server: from 4.1.151 through 4.1.2.191.51, from 5.20.0 through 5.70.0, from 5.2020.2 through 5.2022.5, from 6.2022.1 through 6.2024.12, from 6.0.0 through 6.21.0; Payara Micro: from
h 5.70.0, from 5.2020.2 through 5.2022.5, from 6.2022.1 through 6.2024.12, from 6.0.0 through 6.21.0; Payara Micro: from 4.1.152 through 4.1.2.191.51, from 5.20.0 through 5.70.0, from 5.2020.2 through 5.2022.5, from 6.2022.1 through 6.2024.12, from 6.0.0 through 6.21.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.payara.fish/enterprise/docs/Release%20Notes/Release%20Notes%206.22.0.html - https://docs.payara.fish/enterprise/docs/5.71.0/Release%20Notes/Release%20Notes%205.71.0.html - https://docs.payara.fish/community/docs/6.2025.1/Release%20Notes/Release%20Notes%206.2025.1.html
CVE ID: CVE-2024-45689 State: PUBLISHED Published: 2024-11-20T10:22:48.635Z Last Updated: 2024-11-20T19:18:18.428Z Description: A flaw was found in Moodle. Dynamic tables did not enforce capability checks, which resulted in users having the ability to retrieve information they did not have permission to access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2309941
CVE ID: CVE-2024-45690 State: PUBLISHED Published: 2024-11-20T10:23:38.420Z Last Updated: 2024-11-27T14:15:55.442Z Description: A flaw was found in Moodle. Additional checks were required to ensure users can only delete their OAuth2-linked accounts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2309939 - https://moodle.org/security/
CVE ID: CVE-2024-45691 State: PUBLISHED Published: 2024-11-20T10:25:30.380Z Last Updated: 2024-11-20T19:17:19.480Z Description: A flaw was found in Moodle. When restricting access to a lesson activity with a password, certain passwords could be bypassed or less secure due to a loose comparison in the password-checking logic. This issue only affected passwords set to "magic hash" values. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2309940 - https://moodle.org/security/
CVE ID: CVE-2024-45692 State: PUBLISHED Published: 2024-09-04T00:00:00 Last Updated: 2024-09-05T13:43:51.165Z Vendors: n/a Products: n/a Problem Types: n/a Description: Webmin before 2.202 and Virtualmin before 7.20.2 allow a network traffic loop via spoofed UDP packets on port 10000. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cispa.de/en/loop-dos - https://webmin.com - https://www.openwall.com/lists/oss-security/2024/09/04/1
CVE ID: CVE-2024-45693 State: PUBLISHED Published: 2024-10-16T07:52:25.816Z Last Updated: 2024-10-16T14:57:41.020Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N) Vendors: Apache Software Foundation Products: Apache CloudStack Problem Types: CWE-352 Description: Users logged into the Apache CloudStack's web interface can be tricked to submit malicious CSRF requests due to missing validation of the origin of the requests. This can allow an attacker to gain privileges and access to resources of the authenticated users and may lead to account takeover, disruption, exposure of sensitive data and compromise integrity of the resources owned by the user account that are managed
ruption, exposure of sensitive data and compromise integrity of the resources owned by the user account that are managed by the platform. This issue affects Apache CloudStack from 4.15.1.0 through 4.18.2.3 and 4.19.0.0 through 4.19.1.1 Users are recommended to upgrade to Apache CloudStack 4.18.2.4 or 4.19.1.2, or later, which addresses this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cloudstack.apache.org/blog/security-release-advisory-4.18.2.4-4.19.1.2 - https://lists.apache.org/thread/ktsfjcnj22x4kg49ctock3d9tq7jnvlo - https://cloudstack.apache.org/blog/security-release-advisory-4.18.2.4-4.19.1.2
CVE ID: CVE-2024-45694 State: PUBLISHED Published: 2024-09-16T06:33:25.812Z Last Updated: 2024-09-16T13:48:12.763Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: D-Link Products: DIR-X5460 A1, DIR-X4860 A1 Problem Types: CWE-121 Description: The web service of certain models of D-Link wireless routers contains a Stack-based Buffer Overflow vulnerability, which allows unauthenticated remote attackers to exploit this vulnerability to execute arbitrary code on the device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-8080-7f494-1.html - https://www.twcert.org.tw/en/cp-139-8081-3fb39-2.html