Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-24390 State: PUBLISHED Published: 2025-01-27T05:59:20.511Z Last Updated: 2025-02-12T20:01:13.513Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: OTRS AG Products: OTRS Problem Types: CWE-614 Description: A vulnerability in OTRS Application Server and reverse proxy settings allows session hijacking due to missing attributes for sensitive cookie settings in HTTPS sessions. This issue affects: * OTRS 7.0.X * OTRS 8.0.X * OTRS 2023.X * OTRS 2024.X Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://otrs.com/release-notes/otrs-security-advisory-2025-04/
CVE ID: CVE-2025-24391 State: PUBLISHED Published: 2025-07-14T08:15:58.668Z Last Updated: 2025-07-14T12:58:02.638Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: OTRS AG Products: OTRS Problem Types: CWE-203 Description: A vulnerability in the External Interface of OTRS allows conclusions to be drawn about the existence of user accounts through different HTTP response codes and messages. This enables an attacker to systematically identify valid email addresses. This issue affects: * OTRS 7.0.X * OTRS 8.0.X * OTRS 2023.X * OTRS 2024.X * OTRS 2025.X Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://otrs.com/release-notes/otrs-security-a
S 2025.X Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://otrs.com/release-notes/otrs-security-advisory-2025-07/
CVE ID: CVE-2025-24397 State: PUBLISHED Published: 2025-01-22T17:02:51.699Z Last Updated: 2025-01-23T16:11:07.171Z Vendors: Jenkins Project Products: Jenkins GitLab Plugin Description: An incorrect permission check in Jenkins GitLab Plugin 1.9.6 and earlier allows attackers with global Item/Configure permission (while lacking Item/Configure permission on any particular job) to enumerate credential IDs of GitLab API token and Secret text credentials stored in Jenkins. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2025-01-22/#SECURITY-3260
CVE ID: CVE-2025-24398 State: PUBLISHED Published: 2025-01-22T17:02:52.362Z Last Updated: 2025-01-23T16:08:58.969Z Vendors: Jenkins Project Products: Jenkins Bitbucket Server Integration Plugin Description: Jenkins Bitbucket Server Integration Plugin 2.1.0 through 4.1.3 (both inclusive) allows attackers to craft URLs that would bypass the CSRF protection of any target URL in Jenkins. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2025-01-22/#SECURITY-3434
CVE ID: CVE-2025-24399 State: PUBLISHED Published: 2025-01-22T17:02:52.963Z Last Updated: 2025-03-18T14:52:01.739Z Vendors: Jenkins Project Products: Jenkins OpenId Connect Authentication Plugin Description: Jenkins OpenId Connect Authentication Plugin 4.452.v2849b_d3945fa_ and earlier, except 4.438.440.v3f5f201de5dc, treats usernames as case-insensitive, allowing attackers on Jenkins instances configured with a case-sensitive OpenID Connect provider to log in as any user by providing a username that differs only in letter case, potentially gaining administrator access to Jenkins. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2025-0
enkins. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2025-01-22/#SECURITY-3461
CVE ID: CVE-2025-24400 State: PUBLISHED Published: 2025-01-22T17:02:53.578Z Last Updated: 2025-03-20T14:05:53.434Z Vendors: Jenkins Project Products: Jenkins Eiffel Broadcaster Plugin Description: Jenkins Eiffel Broadcaster Plugin 2.8.0 through 2.10.2 (both inclusive) uses the credential ID as the cache key during signing operations, allowing attackers able to create a credential with the same ID as a legitimate one in a different credentials store to sign an event published to RabbitMQ with the legitimate credentials. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2025-01-22/#SECURITY-3485
CVE ID: CVE-2025-24401 State: PUBLISHED Published: 2025-01-22T17:02:54.209Z Last Updated: 2025-01-23T16:07:38.504Z Vendors: Jenkins Project Products: Jenkins Folder-based Authorization Strategy Plugin Description: Jenkins Folder-based Authorization Strategy Plugin 217.vd5b_18537403e and earlier does not verify that permissions configured to be granted are enabled, potentially allowing users formerly granted (typically optional permissions, like Overall/Manage) to access functionality they're no longer entitled to. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2025-01-22/#SECURITY-3062
CVE ID: CVE-2025-24402 State: PUBLISHED Published: 2025-01-22T17:02:54.831Z Last Updated: 2025-01-23T15:59:57.502Z Vendors: Jenkins Project Products: Jenkins Azure Service Fabric Plugin Description: A cross-site request forgery (CSRF) vulnerability in Jenkins Azure Service Fabric Plugin 1.6 and earlier allows attackers to connect to a Service Fabric URL using attacker-specified credentials IDs obtained through another method. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2025-01-22/#SECURITY-3094
CVE ID: CVE-2025-24403 State: PUBLISHED Published: 2025-01-22T17:02:55.460Z Last Updated: 2025-01-23T15:58:42.139Z Vendors: Jenkins Project Products: Jenkins Azure Service Fabric Plugin Description: A missing permission check in Jenkins Azure Service Fabric Plugin 1.6 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of Azure credentials stored in Jenkins. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2025-01-22/#SECURITY-3094
CVE ID: CVE-2025-24404 State: PUBLISHED Published: 2025-09-09T09:30:59.424Z Last Updated: 2025-11-04T21:09:42.310Z Vendors: Apache Software Foundation Products: Apache HertzBeat (incubating) Problem Types: CWE-91 Description: XML Injection RCE by parse http sitemap xml response vulnerability in Apache HertzBeat. The attacker needs to have an authenticated account with access, and add monitor parsed by xml, returned special content can trigger the XML parsing vulnerability. This issue affects Apache HertzBeat (incubating): before 1.7.0. Users are recommended to upgrade to version 1.7.0, which fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: Referenc
rsion 1.7.0, which fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lists.apache.org/thread/4ydy3tqbpwmhl79mcj3pxwqz62nggrfd
CVE ID: CVE-2025-24406 State: PUBLISHED Published: 2025-02-11T17:37:40.430Z Last Updated: 2025-03-17T20:51:05.033Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: Adobe Products: Adobe Commerce Problem Types: CWE-22 Description: Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to a security feature bypass. An unauthenticated attacker could exploit this vulnerability to modify files that are stored outside the restricted directory. Exploitation of this issue does not require user interaction. Ad
files that are stored outside the restricted directory. Exploitation of this issue does not require user interaction. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/magento/apsb25-08.html
CVE ID: CVE-2025-24407 State: PUBLISHED Published: 2025-02-11T17:37:43.703Z Last Updated: 2025-03-17T21:02:58.933Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) Vendors: Adobe Products: Adobe Commerce Problem Types: CWE-863 Description: Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. A low privileged attacker could exploit this vulnerability to perform actions with permissions that were not granted leading to both a High impact to confidentiality and Low impact to integrity. Exploitation of this issue does not require user
g to both a High impact to confidentiality and Low impact to integrity. Exploitation of this issue does not require user interaction. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/magento/apsb25-08.html
CVE ID: CVE-2025-24408 State: PUBLISHED Published: 2025-02-11T17:37:32.198Z Last Updated: 2025-02-27T20:38:10.912Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Adobe Products: Adobe Commerce Problem Types: CWE-200 Description: Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Information Exposure vulnerability that could result in privilege escalation. A low-privileged attacker could gain unauthorized access to sensitive information. Exploitation of this issue does not require user interaction. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/produc
er interaction. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/magento/apsb25-08.html
CVE ID: CVE-2025-24409 State: PUBLISHED Published: 2025-02-11T17:37:38.725Z Last Updated: 2025-03-17T21:02:36.064Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) Vendors: Adobe Products: Adobe Commerce Problem Types: CWE-863 Description: Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized access, leading to both a High impact to confidentiality and Low impact to integrity. Exploitation of this issue does not require user interaction.
igh impact to confidentiality and Low impact to integrity. Exploitation of this issue does not require user interaction. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/magento/apsb25-08.html
CVE ID: CVE-2025-24410 State: PUBLISHED Published: 2025-02-11T17:37:33.017Z Last Updated: 2025-02-27T20:38:12.890Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N) Vendors: Adobe Products: Adobe Commerce Problem Types: CWE-79 Description: Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. A successful attacker can abuse this to achieve session
er when they browse to the page containing the vulnerable field. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality and integrity impact as high. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/magento/apsb25-08.html
CVE ID: CVE-2025-24411 State: PUBLISHED Published: 2025-02-11T17:37:51.772Z Last Updated: 2025-04-15T16:32:22.217Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: Adobe Products: Adobe Commerce Problem Types: CWE-284 Description: Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized access affecting Confidentiality and Integrity. Exploitation of this issue does not require user interaction. Additional Analyst Note
ing Confidentiality and Integrity. Exploitation of this issue does not require user interaction. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/magento/apsb25-08.html
CVE ID: CVE-2025-24412 State: PUBLISHED Published: 2025-02-11T17:37:36.216Z Last Updated: 2025-02-27T20:38:13.659Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N) Vendors: Adobe Products: Adobe Commerce Problem Types: CWE-79 Description: Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. A successful attacker can abuse this to achieve session
CVE ID: CVE-2025-24413 State: PUBLISHED Published: 2025-02-11T17:37:49.367Z Last Updated: 2025-02-27T20:38:13.267Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N) Vendors: Adobe Products: Adobe Commerce Problem Types: CWE-79 Description: Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. A successful attacker can abuse this to achieve session
CVE ID: CVE-2025-24414 State: PUBLISHED Published: 2025-02-11T17:37:55.122Z Last Updated: 2025-02-27T20:38:14.409Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N) Vendors: Adobe Products: Adobe Commerce Problem Types: CWE-79 Description: Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. A successful attacker can abuse this to achieve session
CVE ID: CVE-2025-24415 State: PUBLISHED Published: 2025-02-11T17:37:52.600Z Last Updated: 2025-02-27T20:38:15.157Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N) Vendors: Adobe Products: Adobe Commerce Problem Types: CWE-79 Description: Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. A successful attacker can abuse this to achieve session
CVE ID: CVE-2025-24416 State: PUBLISHED Published: 2025-02-11T17:37:50.979Z Last Updated: 2025-02-27T20:38:08.644Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N) Vendors: Adobe Products: Adobe Commerce Problem Types: CWE-79 Description: Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. A successful attacker can abuse this to achieve session
CVE ID: CVE-2025-24417 State: PUBLISHED Published: 2025-02-11T17:37:39.575Z Last Updated: 2025-02-27T20:38:14.780Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N) Vendors: Adobe Products: Adobe Commerce Problem Types: CWE-79 Description: Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. A successful attacker can abuse this to achieve session
CVE ID: CVE-2025-24418 State: PUBLISHED Published: 2025-02-11T17:37:41.236Z Last Updated: 2025-02-27T20:38:12.051Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: Adobe Products: Adobe Commerce Problem Types: CWE-285 Description: Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Improper Authorization vulnerability that could result in Privilege escalation. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized access. Exploitation of this issue does not require user interaction. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http
n of this issue does not require user interaction. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/magento/apsb25-08.html
CVE ID: CVE-2025-24419 State: PUBLISHED Published: 2025-02-11T17:37:48.559Z Last Updated: 2025-04-15T16:47:11.921Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Adobe Products: Adobe Commerce Problem Types: CWE-863 Description: Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. A low-privileged attacker could exploit this vulnerability to modify select data. Exploitation of this issue does not require user interaction. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security
uire user interaction. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/magento/apsb25-08.html
CVE ID: CVE-2025-24420 State: PUBLISHED Published: 2025-02-11T17:37:50.175Z Last Updated: 2025-04-15T16:49:03.773Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Adobe Products: Adobe Commerce Problem Types: CWE-863 Description: Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. A low-privileged attacker could exploit this vulnerability to modify select data. Exploitation of this issue does not require user interaction. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security
CVE ID: CVE-2025-24421 State: PUBLISHED Published: 2025-02-11T17:37:37.036Z Last Updated: 2025-04-16T19:26:19.966Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Adobe Products: Adobe Commerce Problem Types: CWE-863 Description: Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. A low-privileged attacker could exploit this vulnerability to read select data. Exploitation of this issue does not require user interaction Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/pr
re user interaction Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/magento/apsb25-08.html
CVE ID: CVE-2025-24422 State: PUBLISHED Published: 2025-02-11T17:37:55.917Z Last Updated: 2025-04-15T16:53:25.808Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Adobe Products: Adobe Commerce Problem Types: CWE-284 Description: Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploitation of this issue does not require user interaction. Additional Analyst Notes: - CISA ADP Vulnrichment: Refer
. Exploitation of this issue does not require user interaction. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/magento/apsb25-08.html
CVE ID: CVE-2025-24423 State: PUBLISHED Published: 2025-02-11T17:37:42.046Z Last Updated: 2025-04-15T16:56:29.280Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Adobe Products: Adobe Commerce Problem Types: CWE-284 Description: Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Improper Access Control vulnerability that could result in Privilege escalation. A low-privileged attacker could leverage this vulnerability to modify select data. Exploitation of this issue does not require user interaction. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/pro
user interaction. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/magento/apsb25-08.html
CVE ID: CVE-2025-24424 State: PUBLISHED Published: 2025-02-11T17:37:46.958Z Last Updated: 2025-04-15T16:58:07.477Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Adobe Products: Adobe Commerce Problem Types: CWE-284 Description: Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploitation of this issue does not require user interaction. Additional Analyst Notes: - CISA ADP Vulnrichment: Refer
CVE ID: CVE-2025-24425 State: PUBLISHED Published: 2025-02-11T17:37:37.917Z Last Updated: 2025-02-27T20:38:16.282Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: Adobe Products: Adobe Commerce Problem Types: CWE-840 Description: Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a Business Logic Error vulnerability that could result in a security feature bypass. An attacker could exploit this vulnerability to circumvent intended security mechanisms by manipulating the logic of the application's operations causing limited data modification. Exploitation of this issue does not require user interaction. Ad
ication's operations causing limited data modification. Exploitation of this issue does not require user interaction. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/magento/apsb25-08.html
CVE ID: CVE-2025-24426 State: PUBLISHED Published: 2025-02-11T17:37:34.615Z Last Updated: 2025-04-15T16:59:24.313Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Adobe Products: Adobe Commerce Problem Types: CWE-284 Description: Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploitation of this issue does not require user interaction. Additional Analyst Notes: - CISA ADP Vulnrichment: Refer