Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-45103 State: PUBLISHED Published: 2024-09-13T17:28:26.004Z Last Updated: 2024-09-13T17:49:12.258Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: Lenovo Products: XClarity Administrator Problem Types: CWE-282 Description: A valid, authenticated LXCA user may be able to unmanage an LXCA managed device in through the LXCA web interface without sufficient privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.lenovo.com/us/en/product_security/LEN-154748
CVE ID: CVE-2024-45104 State: PUBLISHED Published: 2024-09-13T17:28:55.910Z Last Updated: 2024-09-13T17:48:48.901Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Lenovo Products: XClarity Administrator Problem Types: CWE-282 Description: A valid, authenticated LXCA user without sufficient privileges may be able to use the device identifier to modify an LXCA managed device through a specially crafted web API call. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.lenovo.com/us/en/product_security/LEN-154748
CVE ID: CVE-2024-45105 State: PUBLISHED Published: 2024-09-13T17:29:08.267Z Last Updated: 2024-09-16T17:38:38.871Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Lenovo Products: HX5530 Appliance (ThinkAgile) BIOS, HX645 V3 Integrated System (ThinkAgile) BIOS, HX665 V3 Certified Node (ThinkAgile) BIOS, ST250 V3 (ThinkSystem) BIOS, VX3331 Certified Node (ThinkAgile) BIOS, HX1331 Certified Node (ThinkAgile) BIOS, HX2330 Appliance (ThinkAgile) BIOS, HX2331 Certified Node (ThinkAgile) BIOS, HX3330 Appliance (ThinkAgile) BIOS, HX3331 Certified Node (ThinkAgile) BIOS, HX3331 Node SAP HANA (ThinkAgile) BIOS, HX3375 Appliance (ThinkAgile) BIOS, HX3376 Certified Nod
Node (ThinkAgile) BIOS, HX3331 Node SAP HANA (ThinkAgile) BIOS, HX3375 Appliance (ThinkAgile) BIOS, HX3376 Certified Node (ThinkAgile) BIOS, HX5531 Certified Node (ThinkAgile) BIOS, HX630 V3 Certified Node (ThinkAgile) BIOS, HX630 V3 Integrated System (ThinkAgile) BIOS, HX645 V3 Certified Node (ThinkAgile) BIOS, HX650 V3 Certified Node (ThinkAgile) BIOS, HX650 V3 Integrated System (ThinkAgile) BIOS, HX665 V3 Integrated System (ThinkAgile) BIOS, HX665 V3 Storage Certified Node (ThinkAgile) BIOS, HX665 V3 Storage Integrated Node (ThinkAgile) BIOS, HX7530 Appl for SAP HANA (ThinkAgile) BIOS, HX7531 Certified Node (ThinkAgile) BIOS, HX7531 Node SAP HANA (ThinkAgile) BIOS, MX3330-F All-flash Appl
inkAgile) BIOS, HX7531 Certified Node (ThinkAgile) BIOS, HX7531 Node SAP HANA (ThinkAgile) BIOS, MX3330-F All-flash Appliance (ThinkAgile) BIOS, MX3330-H Hybrid Appliance (ThinkAgile) BIOS, MX3331-F All-flash Certified node (ThinkAgile) BIOS, MX3331-H Hybrid Certified node (ThinkAgile) BIOS, MX3530 F All flash Appliance (ThinkAgile) BIOS, MX3530-H Hybrid Appliance (ThinkAgile) BIOS, MX3531 H Hybrid Certified node (ThinkAgile) BIOS, MX3531-F All-flash Certified node (ThinkAgile) BIOS, MX630 V3 Certified Node (ThinkAgile) BIOS, MX630 V3 Integrated System (ThinkAgile) BIOS, MX650 V3 Certified Node (ThinkAgile) BIOS, MX650 v3 Integrated System (ThinkAgile) BIOS, SD530 V3 (ThinkSystem) BIOS, SD55
650 V3 Certified Node (ThinkAgile) BIOS, MX650 v3 Integrated System (ThinkAgile) BIOS, SD530 V3 (ThinkSystem) BIOS, SD550 V3 (ThinkSystem) BIOS, SD630 V2 (ThinkSystem) BIOS, SD650 V2 (ThinkSystem) BIOS, SD650 V3 (ThinkSystem) BIOS, SD650-N V2 (ThinkSystem) BIOS, SD665 V3 (ThinkSystem) BIOS, SE350 V2 (ThinkEdge) BIOS, SE360 V2 (ThinkEdge) BIOS, SE450 (ThinkEdge) BIOS, SE455 V3 (ThinkEdge) BIOS, SN550 V2 (ThinkSystem) BIOS, SR250 V2 (ThinkSystem) BIOS, SR250 V3 (ThinkSystem) BIOS, SR258 V2 (ThinkSystem) BIOS, SR258 V3 (ThinkSystem) BIOS, SR630 V2 (ThinkSystem) BIOS, SR630 V3 (ThinkSystem) BIOS, SR635 V3 (ThinkSystem) BIOS, SR645 (ThinkSystem) BIOS, SR645 V3 (ThinkSystem) BIOS, SR650 V2 (ThinkS
(ThinkSystem) BIOS, SR635 V3 (ThinkSystem) BIOS, SR645 (ThinkSystem) BIOS, SR645 V3 (ThinkSystem) BIOS, SR650 V2 (ThinkSystem) BIOS, SR650 V3 (ThinkSystem) BIOS, SR655 V3 (ThinkSystem) BIOS, SR665 (ThinkSystem) BIOS, SR665 V3 (ThinkSystem) BIOS, SR670 V2 (ThinkSystem) BIOS, SR675 V3 (ThinkSystem) BIOS, SR850 V2 (ThinkSystem) BIOS, SR850 V3 (ThinkSystem) BIOS, SR860 V2 (ThinkSystem) BIOS, SR860 V3 (ThinkSystem) BIOS, SR950 V3 (ThinkSystem) BIOS, ST250 V2 (ThinkSystem) BIOS, ST258 V2 (ThinkSystem) BIOS, ST258 V3 (ThinkSystem) BIOS, ST650 V2 (ThinkSystem) BIOS, ST650 V3 (ThinkSystem) BIOS, ST658 V2 (ThinkSystem) BIOS, ST658 V3 (ThinkSystem) BIOS, VX2330 Appliance (ThinkAgile) BIOS, VX3330 Appli
System) BIOS, ST658 V2 (ThinkSystem) BIOS, ST658 V3 (ThinkSystem) BIOS, VX2330 Appliance (ThinkAgile) BIOS, VX3330 Appliance (ThinkAgile) BIOS, VX3530-G Appliance (ThinkAgile) BIOS, VX5530 Appliance (ThinkAgile) BIOS, VX630 V3 Certified Node (ThinkAgile) BIOS, VX635 V3 Certified Node (ThinkAgile) BIOS, VX635 V3 Integrated System (ThinkAgile) BIOS, VX645 V3 Certified Node (ThinkAgile) BIOS, VX645 V3 Integrated System (ThinkAgile) BIOS, VX650 V3 Certified Node (ThinkAgile) BIOS, VX650 V3 DPU Certified Node (ThinkAgile) BIOS, VX650 V3 DPU Integrated System (ThinkAgile) BIOS, VX650 V3 DPU SAP HANA Certified Node (ThinkAgile) BIOS, VX650 V3 Integrated System (ThinkAgile) BIOS, VX650 V3 SAP HANA C
X650 V3 DPU SAP HANA Certified Node (ThinkAgile) BIOS, VX650 V3 Integrated System (ThinkAgile) BIOS, VX650 V3 SAP HANA Certified Node (ThinkAgile) BIOS, VX655 V3 Certified Node (ThinkAgile) BIOS, VX655 V3 Integrated System (ThinkAgile) BIOS, VX665 V3 Certified Node (ThinkAgile) BIOS, VX665 V3 Integrated System (ThinkAgile) BIOS, VX7330 Appliance (Thinkagile) BIOS, VX7530 Appliance (ThinkAgile) BIOS, VX7531 Certified Node (ThinkAgile) BIOS Problem Types: CWE-825 Description: An internal product security audit discovered a UEFI SMM (System Management Mode) callout vulnerability in some ThinkSystem servers that could allow a local attacker with elevated privileges to execute arbitrary code. Add
ty in some ThinkSystem servers that could allow a local attacker with elevated privileges to execute arbitrary code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.lenovo.com/us/en/product_security/LEN-165524
CVE ID: CVE-2024-45106 State: PUBLISHED Published: 2024-12-03T09:06:23.356Z Last Updated: 2024-12-03T15:52:28.971Z Vendors: Apache Software Foundation Products: Apache Ozone Problem Types: CWE-287 Description: Improper authentication of an HTTP endpoint in the S3 Gateway of Apache Ozone 1.4.0 allows any authenticated Kerberos user to revoke and regenerate the S3 secrets of any other user. This is only possible if: * ozone.s3g.secret.http.enabled is set to true. The default value of this configuration is false. * The user configured in ozone.s3g.kerberos.principal is also configured in ozone.s3.administrators or ozone.administrators. Users are recommended to upgrade to Apache Ozone version 1.
nfigured in ozone.s3.administrators or ozone.administrators. Users are recommended to upgrade to Apache Ozone version 1.4.1 which disables the affected endpoint. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/rylnxwttp004kvotpk9j158vb238pfkm
CVE ID: CVE-2024-45107 State: PUBLISHED Published: 2024-09-05T08:48:09.064Z Last Updated: 2024-09-05T12:59:01.912Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: Adobe Products: Acrobat Reader Problem Types: CWE-416 Description: Acrobat Reader versions 20.005.30636, 24.002.20964, 24.001.30123, 24.002.20991 and earlier are affected by a Use After Free vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - ht
raction in that a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/acrobat/apsb24-57.html
CVE ID: CVE-2024-45108 State: PUBLISHED Published: 2024-09-13T09:37:03.249Z Last Updated: 2024-09-18T14:14:19.534Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Photoshop Desktop Problem Types: CWE-787 Description: Photoshop Desktop versions 24.7.4, 25.11 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/photoshop/apsb24-72.html
CVE ID: CVE-2024-45109 State: PUBLISHED Published: 2024-09-13T09:37:04.831Z Last Updated: 2024-09-18T14:13:39.868Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Photoshop Desktop Problem Types: CWE-787 Description: Photoshop Desktop versions 24.7.4, 25.11 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/photoshop/apsb24-72.html
CVE ID: CVE-2024-45111 State: PUBLISHED Published: 2024-09-13T08:37:29.933Z Last Updated: 2024-09-13T14:06:36.559Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: Adobe Products: Illustrator Problem Types: CWE-125 Description: Illustrator versions 28.6, 27.9.5 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/ill
ous file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/illustrator/apsb24-66.html
CVE ID: CVE-2024-45112 State: PUBLISHED Published: 2024-09-13T08:58:58.128Z Last Updated: 2024-09-13T13:42:56.318Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Acrobat Reader Problem Types: CWE-843 Description: Acrobat Reader versions 24.002.21005, 24.001.30159, 20.005.30655, 24.003.20054 and earlier are affected by a Type Confusion vulnerability that could result in arbitrary code execution in the context of the current user. This issue occurs when a resource is accessed using a type that is not compatible with the actual object type, leading to a logic error that an attacker could exploit. Exploitation of this issue requires user interacti
object type, leading to a logic error that an attacker could exploit. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/acrobat/apsb24-70.html
CVE ID: CVE-2024-45113 State: PUBLISHED Published: 2024-09-13T09:18:02.435Z Last Updated: 2024-09-16T12:56:24.654Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: Adobe Products: ColdFusion Problem Types: CWE-287 Description: ColdFusion versions 2023.6, 2021.12 and earlier are affected by an Improper Authentication vulnerability that could result in privilege escalation. An attacker could exploit this vulnerability to gain unauthorized access and affect the integrity of the application. Exploitation of this issue does not require user interaction. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/coldfus
tion. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/coldfusion/apsb24-14.html
CVE ID: CVE-2024-45114 State: PUBLISHED Published: 2024-11-12T18:54:11.368Z Last Updated: 2024-11-12T19:58:59.174Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Illustrator Problem Types: CWE-787 Description: Illustrator versions 28.7.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/illustrator/apsb24-87.html
CVE ID: CVE-2024-45115 State: PUBLISHED Published: 2024-10-10T09:58:01.453Z Last Updated: 2024-10-10T13:41:43.590Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Adobe Commerce Problem Types: CWE-287 Description: Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Authentication vulnerability that could result in privilege escalation. An attacker could exploit this vulnerability to gain unauthorized access or elevated privileges within the application. Exploitation of this issue does not require user interaction. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://hel
is issue does not require user interaction. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/magento/apsb24-73.html
CVE ID: CVE-2024-45116 State: PUBLISHED Published: 2024-10-10T09:57:59.730Z Last Updated: 2024-10-10T13:57:57.049Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N) Vendors: Adobe Products: Adobe Commerce Problem Types: CWE-79 Description: Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by a Cross-Site Scripting (XSS) vulnerability that could be exploited to execute arbitrary code. If an admin attacker can trick a user into clicking a specially crafted link or submitting a form, malicious scripts may be executed within the context of the victim's browser and have high impact on confidentiality and integrity. Exploitation of this i
within the context of the victim's browser and have high impact on confidentiality and integrity. Exploitation of this issue requires user interaction. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/magento/apsb24-73.html
CVE ID: CVE-2024-45117 State: PUBLISHED Published: 2024-10-10T09:58:00.638Z Last Updated: 2024-10-10T14:24:40.824Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L) Vendors: Adobe Products: Adobe Commerce Problem Types: CWE-20 Description: Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Input Validation vulnerability that could lead to arbitrary file system read. An admin attacker could exploit this vulnerability to read files from the system outside of the intended directories via PHP filter chain and also can have a low-availability impact on the service. Exploitation of this issue does not require user interactio
and also can have a low-availability impact on the service. Exploitation of this issue does not require user interaction and scope is changed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/magento/apsb24-73.html
CVE ID: CVE-2024-45118 State: PUBLISHED Published: 2024-10-10T09:57:51.201Z Last Updated: 2024-10-10T13:45:35.642Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: Adobe Products: Adobe Commerce Problem Types: CWE-284 Description: Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and have high impact on integrity. Exploitation of this issue does not require user interaction. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https
of this issue does not require user interaction. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/magento/apsb24-73.html
CVE ID: CVE-2024-45119 State: PUBLISHED Published: 2024-10-10T09:57:58.983Z Last Updated: 2024-12-12T17:32:19.594Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: Adobe Products: Adobe Commerce Problem Types: CWE-918 Description: Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 (and earlier) are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to arbitrary file system read. An admin-privilege authenticated attacker can force the application to make arbitrary requests via injection of arbitrary URLs. Exploitation of this issue does not require user interaction. Additional Analyst Notes: - CISA ADP Vulnrichment: Ref
Ls. Exploitation of this issue does not require user interaction. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/magento/apsb24-73.html
CVE ID: CVE-2024-45120 State: PUBLISHED Published: 2024-10-10T09:57:56.691Z Last Updated: 2024-12-12T17:36:42.455Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Adobe Products: Adobe Commerce Problem Types: CWE-367 Description: Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability that could lead to a security feature bypass. An attacker could exploit this vulnerability to alter a condition between the check and the use of a resource, having a low impact on integrity. Exploitation of this issue requires user interaction. Additional Analyst Notes: - CISA ADP
ng a low impact on integrity. Exploitation of this issue requires user interaction. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/magento/apsb24-73.html
CVE ID: CVE-2024-45121 State: PUBLISHED Published: 2024-10-10T09:58:02.296Z Last Updated: 2024-10-10T14:24:07.969Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Adobe Products: Adobe Commerce Problem Types: CWE-284 Description: Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and have a low impact on integrity. Exploitation of this issue does not require user interaction. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http
n of this issue does not require user interaction. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/magento/apsb24-73.html
CVE ID: CVE-2024-45122 State: PUBLISHED Published: 2024-10-10T09:57:58.231Z Last Updated: 2024-10-10T14:00:07.731Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Adobe Products: Adobe Commerce Problem Types: CWE-284 Description: Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and have a low impact on confidentiality. Exploitation of this issue does not require user interaction. Additional Analyst Notes: - CISA ADP Vulnrichment: References:
itation of this issue does not require user interaction. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/magento/apsb24-73.html
CVE ID: CVE-2024-45123 State: PUBLISHED Published: 2024-10-10T09:58:03.098Z Last Updated: 2024-10-10T14:20:13.166Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Adobe Products: Adobe Commerce Problem Types: CWE-79 Description: Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/magen
rowser. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/magento/apsb24-73.html
CVE ID: CVE-2024-45124 State: PUBLISHED Published: 2024-10-10T09:58:03.845Z Last Updated: 2024-10-10T13:55:37.675Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: Adobe Products: Adobe Commerce Problem Types: CWE-284 Description: Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and have a low impact on integrity. Exploitation of this issue does not require user interaction. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adob
e does not require user interaction. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/magento/apsb24-73.html
CVE ID: CVE-2024-45125 State: PUBLISHED Published: 2024-10-10T09:57:49.672Z Last Updated: 2024-10-10T14:06:40.500Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Adobe Products: Adobe Commerce Problem Types: CWE-863 Description: Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. A low-privileged attacker could exploit this vulnerability to have a low impact on integrity. Exploitation of this issue does not require user interaction. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/p
re user interaction. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/magento/apsb24-73.html
CVE ID: CVE-2024-45127 State: PUBLISHED Published: 2024-10-10T09:58:06.189Z Last Updated: 2024-10-10T13:56:06.715Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: Adobe Products: Adobe Commerce Problem Types: CWE-79 Description: Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an admin attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://he
to the page containing the vulnerable field. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/magento/apsb24-73.html
CVE ID: CVE-2024-45128 State: PUBLISHED Published: 2024-10-10T09:58:05.408Z Last Updated: 2024-10-14T10:37:12.555Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: Adobe Products: Adobe Commerce Problem Types: CWE-863 Description: Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and have a low impact on integrity and availability. Exploitation of this issue does not require user interaction. Additional Analyst Notes: - CISA ADP Vulnrichment: Re