Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
richment: References: - https://patchstack.com/database/vulnerability/eu-vat-for-woocommerce/wordpress-eu-uk-vat-manager-for-woocommerce-plugin-2-12-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-44062 State: PUBLISHED Published: 2024-09-15T07:58:38.523Z Last Updated: 2024-09-15T19:49:00.287Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Hiroaki Miyashita Products: Custom Field Template Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Hiroaki Miyashita Custom Field Template allows Stored XSS.This issue affects Custom Field Template: from n/a through 2.6.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/custom-field-template/wordpress-custom-field-template-plugin-2-6-5-cross-s
https://patchstack.com/database/vulnerability/custom-field-template/wordpress-custom-field-template-plugin-2-6-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-44063 State: PUBLISHED Published: 2024-09-15T07:54:07.630Z Last Updated: 2024-09-15T19:49:10.165Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Happyforms Products: Happyforms Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Happyforms allows Stored XSS.This issue affects Happyforms: from n/a through 1.26.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/happyforms/wordpress-happyforms-plugin-1-26-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-44064 State: PUBLISHED Published: 2024-09-17T22:35:57.692Z Last Updated: 2024-09-18T14:08:03.897Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: LikeBtn Products: Like Button Rating Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in LikeBtn Like Button Rating allows Cross-Site Scripting (XSS).This issue affects Like Button Rating: from n/a through 2.6.54. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/likebtn-like-button/wordpress-like-button-rating-likebtn-plugin-2-6-53-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-44067 State: PUBLISHED Published: 2024-08-19T00:00:00 Last Updated: 2024-08-20T19:45:07.970Z Vendors: n/a Products: n/a Problem Types: n/a Description: The T-Head XuanTie C910 CPU in the TH1520 SoC and the T-Head XuanTie C920 CPU in the SOPHON SG2042 have instructions that allow unprivileged attackers to write to arbitrary physical memory locations, aka GhostWrite. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://ghostwriteattack.com
CVE ID: CVE-2024-44068 State: PUBLISHED Published: 2024-10-07T00:00:00 Last Updated: 2024-10-07T18:52:33.089Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the m2m scaler driver in Samsung Mobile Processor and Wearable Processor Exynos 9820, 9825, 980, 990, 850,and W920. A Use-After-Free in the mobile processor leads to privilege escalation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://semiconductor.samsung.com/support/quality-support/product-security-updates/ - https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2024-44068/
CVE ID: CVE-2024-44069 State: PUBLISHED Published: 2024-08-19T00:00:00 Last Updated: 2024-10-29T20:25:31.467Z Vendors: n/a Products: n/a Problem Types: n/a Description: Pi-hole before 6 allows unauthenticated admin/api.php?setTempUnit= calls to change the temperature units of the web dashboard. NOTE: the supplier reportedly does "not consider the bug a security issue" but the specific motivation for letting arbitrary persons change the value (Celsius, Fahrenheit, or Kelvin), seen by the device owner, is unclear. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/pi-hole/web/pull/3077 - https://www.kiyell.com/The-Harmless-Pihole-Bug/
CVE ID: CVE-2024-44070 State: PUBLISHED Published: 2024-08-19T00:00:00.000Z Last Updated: 2025-11-04T16:13:46.559Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in FRRouting (FRR) through 10.1. bgp_attr_encap in bgpd/bgp_attr.c does not check the actual remaining stream length before taking the TLV value. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/FRRouting/frr/pull/16497
CVE ID: CVE-2024-44072 State: PUBLISHED Published: 2024-09-10T06:56:44.182Z Last Updated: 2024-09-10T19:58:39.140Z Vendors: BUFFALO INC. Products: WHR-1166DHP2, WHR-1166DHP3, WHR-1166DHP4, WSR-1166DHP3, WSR-600DHP, WEX-300HPTX/N, WEX-733DHP2, WEX-1166DHP2, WEX-1166DHPS, WEX-300HPS/N, WEX-733DHPS, WEX-733DHPTX, WEX-1166DHP, WEX-733DHP, WHR-1166DHP, WHR-300HP2, WHR-600D, WMR-300 Problem Types: OS command injection Description: OS command injection vulnerability exists in BUFFALO wireless LAN routers and wireless LAN repeaters. If a user logs in to the management page and sends a specially crafted request to the affected product from the product's specific management page, an arbitrary OS comma
s a specially crafted request to the affected product from the product's specific management page, an arbitrary OS command may be executed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.buffalo.jp/news/detail/20240719-01.html - https://jvn.jp/en/jp/JVN12824024/
CVE ID: CVE-2024-44073 State: PUBLISHED Published: 2024-08-19T00:00:00 Last Updated: 2024-09-13T13:28:09.838Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Miniscript (aka rust-miniscript) library before 12.2.0 for Rust allows stack consumption because it does not properly track tree depth. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/rust-bitcoin/rust-miniscript/pull/712 - https://github.com/rust-bitcoin/rust-miniscript/pull/704 - https://github.com/rust-bitcoin/rust-miniscript/compare/11.2.0...12.2.0
CVE ID: CVE-2024-44076 State: PUBLISHED Published: 2024-08-19T00:00:00 Last Updated: 2024-08-19T15:58:39.325Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Microcks before 1.10.0, the POST /api/import and POST /api/export endpoints allow non-administrator access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/microcks/microcks/issues/1212 - https://github.com/microcks/microcks/compare/1.9.1-fix-1...1.10.0 - https://github.com/microcks/microcks/releases/tag/1.10.0
CVE ID: CVE-2024-44080 State: PUBLISHED Published: 2024-10-29T00:00:00 Last Updated: 2024-10-30T14:52:36.024Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Jitsi Meet before 2.0.9779, the functionality to share an image using giphy was implemented in an insecure way, resulting in clients loading GIFs from any arbitrary URL if a message from another participant contains a URL encoded in the expected format. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/jitsi/jitsi-meet/compare/jitsi-meet_9672...jitsi-meet_9673 - https://github.com/jitsi/security-advisories/blob/master/advisories/JSA-2024-0002.md
CVE ID: CVE-2024-44081 State: PUBLISHED Published: 2024-10-29T00:00:00 Last Updated: 2024-10-30T14:47:10.217Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Jitsi Meet before 2.0.9779, the functionality to share a video file was implemented in an insecure way, resulting in clients loading videos from an arbitrary URL if a message from another participant contains a URL encoded in the expected format. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/jitsi/jitsi-meet/compare/jitsi-meet_9672...jitsi-meet_9673 - https://github.com/jitsi/security-advisories/blob/master/advisories/JSA-2024-0003.md
CVE ID: CVE-2024-44082 State: PUBLISHED Published: 2024-09-06T00:00:00 Last Updated: 2024-11-06T18:45:17.902Z Vendors: n/a Products: n/a Problem Types: n/a Description: In OpenStack Ironic before 26.0.1 and ironic-python-agent before 9.13.1, there is a vulnerability in image processing, in which a crafted image could be used by an authenticated user to exploit undesired behaviors in qemu-img, including possible unauthorized access to potentially sensitive data. The affected/fixed version details are: Ironic: <21.4.3, >=22.0.0 <23.0.2, >=23.1.0 <24.1.2, >=25.0.0 <26.0.1; Ironic-python-agent: <9.4.2, >=9.5.0 <9.7.1, >=9.8.0 <9.11.1, >=9.12.0 <9.13.1. Additional Analyst Notes: - CISA ADP Vulnri
nic-python-agent: <9.4.2, >=9.5.0 <9.7.1, >=9.8.0 <9.11.1, >=9.12.0 <9.13.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugs.launchpad.net/ironic/+bug/2071740 - https://www.openwall.com/lists/oss-security/2024/09/04/4 - https://security.openstack.org/ossa/OSSA-2024-003.html
CVE ID: CVE-2024-44083 State: PUBLISHED Published: 2024-08-19T00:00:00.000Z Last Updated: 2025-03-18T20:41:52.654Z Vendors: n/a Products: n/a Problem Types: n/a Description: ida64.dll in Hex-Rays IDA Pro through 8.4 crashes when there is a section that has many jumps linked, and the final jump corresponds to the payload from where the actual entry point will be invoked. NOTE: in many use cases, this is an inconvenience but not a security issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Azvanzed/IdaMeme - https://github.com/Azvanzed/CVE-2024-44083/
CVE ID: CVE-2024-44085 State: PUBLISHED Published: 2024-09-09T00:00:00 Last Updated: 2024-09-10T14:19:57.454Z Vendors: n/a Products: n/a Problem Types: n/a Description: ONLYOFFICE Docs before 8.1.0 allows XSS via a GeneratorFunction Object attack against a macro. This is related to use of an immediately-invoked function expression (IIFE) for a macro. NOTE: this issue exists because of an incorrect fix for CVE-2021-43446 and CVE-2023-50883. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.onlyoffice.com/ - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2023-027.txt - https://www.syss.de/pentest-blog/cross-site-scripting-schwachstelle-in-onlyo
ublikationen/Advisories/SYSS-2023-027.txt - https://www.syss.de/pentest-blog/cross-site-scripting-schwachstelle-in-onlyoffice-docs-syss-2023-027
CVE ID: CVE-2024-44087 State: PUBLISHED Published: 2024-09-10T09:36:52.341Z Last Updated: 2025-05-13T09:38:13.760Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) Vendors: Siemens Products: Automation License Manager V5, Automation License Manager V6.0, Automation License Manager V6.2 Problem Types: CWE-190 Description: A vulnerability has been identified in Automation License Manager V5 (All versions), Automation License Manager V6.0 (All versions < V6.0 SP12 Upd3), Automation License Manager V6.2 (All versions < V6.2 Upd3). Affected applications do not properly validate certain fields in incoming network packets on port 4410/tcp. This could allow an unauthenticated r
not properly validate certain fields in incoming network packets on port 4410/tcp. This could allow an unauthenticated remote attacker to cause an integer overflow and crash of the application. This denial of service condition could prevent legitimate users from using subsequent products that rely on the affected application for license verification. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-103653.html
CVE ID: CVE-2024-44088 State: PUBLISHED Published: 2025-10-14T14:36:52.447Z Last Updated: 2025-11-04T21:08:55.234Z Vendors: Apache Software Foundation Products: Apache Geode Problem Types: CWE-79 Description: Malicious script injection ('Cross-site Scripting') vulnerability in Apache Geode web-api (REST). This vulnerability allows an attacker that tricks a logged-in user into clicking a specially-crafted link to execute code on the returned page, which could lead to theft of the user's session information and even account takeover. This issue affects Apache Geode: all versions prior to 1.15.2 Users are recommended to upgrade to version 1.15.2, which fixes the issue. Additional Analyst Notes:
ons prior to 1.15.2 Users are recommended to upgrade to version 1.15.2, which fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lists.apache.org/thread/161r34nokmcc0w74mnf04lskgb8g1d3g
CVE ID: CVE-2024-44092 State: PUBLISHED Published: 2024-09-13T20:28:35.115Z Last Updated: 2025-09-15T19:25:40.747Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: There is a possible LCS signing enforcement missing due to test/debugging code left in a production build. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/pixel/2024-09-01
CVE ID: CVE-2024-44093 State: PUBLISHED Published: 2024-09-13T20:28:35.306Z Last Updated: 2024-09-16T14:37:19.659Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In ppmp_unprotect_buf of drm/code/drm_fw.c, there is a possible memory corruption due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/pixel/2024-09-01
CVE ID: CVE-2024-44094 State: PUBLISHED Published: 2024-09-13T20:28:35.469Z Last Updated: 2024-09-16T14:36:20.934Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In ppmp_protect_mfcfw_buf of code/drm_fw.c, there is a possible memory corruption due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/pixel/2024-09-01
CVE ID: CVE-2024-44095 State: PUBLISHED Published: 2024-09-13T20:28:35.630Z Last Updated: 2024-10-15T13:22:13.921Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In ppmp_protect_mfcfw_buf of code/drm_fw.c, there is a possible corrupt memory due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/pixel/2024-09-01
CVE ID: CVE-2024-44096 State: PUBLISHED Published: 2024-09-13T20:28:35.816Z Last Updated: 2024-10-15T13:21:28.467Z Vendors: Google Products: Android Problem Types: Information disclosure Description: there is a possible arbitrary read due to an insecure default value. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/pixel/2024-09-01
CVE ID: CVE-2024-44097 State: PUBLISHED Published: 2024-10-02T14:06:33.704Z Last Updated: 2024-10-02T17:00:33.323Z Vendors: Google Products: Android Problem Types: CWE-269 Description: According to the researcher: "The TLS connections are encrypted against tampering or eavesdropping. However, the application does not validate the server certificate properly while initializing the TLS connection. This allows for a network attacker to intercept the connection and read the data. The attacker could the either send the client a malicious response, or forward the (possibly modified) data to the real server." Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.google.co
ed) data to the real server." Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.google.com/product-documentation/answer/14950962?sjid=9489879942601373169-NA
CVE ID: CVE-2024-44098 State: PUBLISHED Published: 2024-10-25T10:34:02.971Z Last Updated: 2024-10-25T16:15:09.381Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In lwis_device_event_states_clear_locked of lwis_event.c, there is a possible privilege escalation due to a double free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/pixel/2024-10-01
CVE ID: CVE-2024-44099 State: PUBLISHED Published: 2024-10-25T10:34:03.377Z Last Updated: 2024-10-25T19:02:23.265Z Vendors: Google Products: Android Problem Types: Information disclosure Description: There is a possible Local bypass of user interaction due to an insecure default value. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/pixel/2024-10-01
CVE ID: CVE-2024-44100 State: PUBLISHED Published: 2024-10-25T10:34:03.553Z Last Updated: 2024-10-25T18:46:51.786Z Vendors: Google Products: Android Problem Types: Information disclosure Description: Android before 2024-10-05 on Google Pixel devices allows information disclosure in the modem component, A-299774545. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/pixel/2024-10-01
CVE ID: CVE-2024-44101 State: PUBLISHED Published: 2024-10-25T10:34:03.747Z Last Updated: 2024-10-25T18:41:53.980Z Vendors: Google Products: Android Problem Types: Denial of service Description: there is a possible Null Pointer Dereference (modem crash) due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/pixel/2024-10-01
CVE ID: CVE-2024-44102 State: PUBLISHED Published: 2024-11-12T12:49:33.464Z Last Updated: 2024-11-15T19:24:48.170Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: PP TeleControl Server Basic 1000 to 5000 V3.1, PP TeleControl Server Basic 256 to 1000 V3.1, PP TeleControl Server Basic 32 to 64 V3.1, PP TeleControl Server Basic 64 to 256 V3.1, PP TeleControl Server Basic 8 to 32 V3.1, TeleControl Server Basic 1000 V3.1, TeleControl Server Basic 256 V3.1, TeleControl Server Basic 32 V3.1, TeleControl Server Basic 5000 V3.1, TeleControl Server Basic 64 V3.1, TeleControl Server Basic 8 V3.1, TeleControl Server Basic Serv Upgr, Tele
c 5000 V3.1, TeleControl Server Basic 64 V3.1, TeleControl Server Basic 8 V3.1, TeleControl Server Basic Serv Upgr, TeleControl Server Basic Upgr V3.1 Problem Types: CWE-502 Description: A vulnerability has been identified in PP TeleControl Server Basic 1000 to 5000 V3.1 (6NH9910-0AA31-0AE1) (All versions < V3.1.2.1 with redundancy configured), PP TeleControl Server Basic 256 to 1000 V3.1 (6NH9910-0AA31-0AD1) (All versions < V3.1.2.1 with redundancy configured), PP TeleControl Server Basic 32 to 64 V3.1 (6NH9910-0AA31-0AF1) (All versions < V3.1.2.1 with redundancy configured), PP TeleControl Server Basic 64 to 256 V3.1 (6NH9910-0AA31-0AC1) (All versions < V3.1.2.1 with redundancy configured)
d), PP TeleControl Server Basic 64 to 256 V3.1 (6NH9910-0AA31-0AC1) (All versions < V3.1.2.1 with redundancy configured), PP TeleControl Server Basic 8 to 32 V3.1 (6NH9910-0AA31-0AB1) (All versions < V3.1.2.1 with redundancy configured), TeleControl Server Basic 1000 V3.1 (6NH9910-0AA31-0AD0) (All versions < V3.1.2.1 with redundancy configured), TeleControl Server Basic 256 V3.1 (6NH9910-0AA31-0AC0) (All versions < V3.1.2.1 with redundancy configured), TeleControl Server Basic 32 V3.1 (6NH9910-0AA31-0AF0) (All versions < V3.1.2.1 with redundancy configured), TeleControl Server Basic 5000 V3.1 (6NH9910-0AA31-0AE0) (All versions < V3.1.2.1 with redundancy configured), TeleControl Server Basic
ver Basic 5000 V3.1 (6NH9910-0AA31-0AE0) (All versions < V3.1.2.1 with redundancy configured), TeleControl Server Basic 64 V3.1 (6NH9910-0AA31-0AB0) (All versions < V3.1.2.1 with redundancy configured), TeleControl Server Basic 8 V3.1 (6NH9910-0AA31-0AA0) (All versions < V3.1.2.1 with redundancy configured), TeleControl Server Basic Serv Upgr (6NH9910-0AA31-0GA1) (All versions < V3.1.2.1 with redundancy configured), TeleControl Server Basic Upgr V3.1 (6NH9910-0AA31-0GA0) (All versions < V3.1.2.1 with redundancy configured). The affected system allows remote users to send maliciously crafted objects. Due to insecure deserialization of user-supplied content by the affected software, an unauthe
liciously crafted objects. Due to insecure deserialization of user-supplied content by the affected software, an unauthenticated attacker could exploit this vulnerability by sending a maliciously crafted serialized object. This could allow the attacker to execute arbitrary code on the device with SYSTEM privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-454789.html
CVE ID: CVE-2024-44103 State: PUBLISHED Published: 2024-09-10T20:39:40.204Z Last Updated: 2025-06-12T17:04:53.415Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Ivanti Products: Workspace Control Problem Types: CWE-426 Description: DLL hijacking in the management console of Ivanti Workspace Control before version 2025.2 (10.19.0.0) allows a local authenticated attacker to escalate their privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Workspace-Control-IWC
CVE ID: CVE-2024-44104 State: PUBLISHED Published: 2024-09-10T20:41:33.032Z Last Updated: 2025-06-12T17:01:17.730Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Ivanti Products: Workspace Control Problem Types: CWE-290 Description: An incorrectly implemented authentication scheme that is subjected to a spoofing attack in the management console of Ivanti Workspace Control before version 2025.2 (10.19.0.0) allows a local authenticated attacker to escalate their privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Workspace-Control-IWC
CVE ID: CVE-2024-44105 State: PUBLISHED Published: 2024-09-10T20:43:26.618Z Last Updated: 2025-06-12T16:58:30.314Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: Ivanti Products: Workspace Control Problem Types: CWE-319 Description: Cleartext transmission of sensitive information in the management console of Ivanti Workspace Control before version 2025.2 (10.19.0.0) allows a local authenticated attacker to obtain OS credentials. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Workspace-Control-IWC
CVE ID: CVE-2024-44106 State: PUBLISHED Published: 2024-09-10T20:45:28.624Z Last Updated: 2025-06-12T17:06:34.123Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Ivanti Products: Workspace Control Problem Types: CWE-602 Description: Insufficient server-side controls in the management console of Ivanti Workspace Control before version 2025.2 (10.19.0.0) allows a local authenticated attacker to escalate their privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Workspace-Control-IWC