Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-25967 State: PUBLISHED Published: 2024-05-14T06:44:22.277Z Last Updated: 2024-08-01T23:52:06.450Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Dell Products: PowerScale OneFS Problem Types: CWE-250 Description: Dell PowerScale OneFS versions 8.2.x through 9.7.0.1 contains an execution with unnecessary privileges vulnerability. A local high privileged attacker could potentially exploit this vulnerability, leading to escalation of privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/en-us/000224860/dsa-2024-163-security-update-for-dell-powerscale-onefs-for-m
ences: - https://www.dell.com/support/kbdoc/en-us/000224860/dsa-2024-163-security-update-for-dell-powerscale-onefs-for-multiple-security-vulnerabilities
CVE ID: CVE-2024-25968 State: PUBLISHED Published: 2024-05-14T06:32:54.927Z Last Updated: 2024-08-01T23:52:06.103Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Dell Products: PowerScale OneFS Problem Types: CWE-327 Description: Dell PowerScale OneFS versions 8.2.x through 9.7.0.2 contains a use of a broken or risky cryptographic algorithm vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to information disclosure. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/en-us/000224860/dsa-2024-163-security-update-for-dell-powerscale-on
er: References: - https://www.dell.com/support/kbdoc/en-us/000224860/dsa-2024-163-security-update-for-dell-powerscale-onefs-for-multiple-security-vulnerabilities
CVE ID: CVE-2024-25969 State: PUBLISHED Published: 2024-05-14T07:24:02.797Z Last Updated: 2024-08-01T23:52:06.516Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Dell Products: PowerScale OneFS Problem Types: CWE-770 Description: Dell PowerScale OneFS versions 8.2.x through 9.7.0.1 contains an allocation of resources without limits or throttling vulnerability. A local unauthenticated attacker could potentially exploit this vulnerability, leading to denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/en-us/000224860/dsa-2024-163-security-update-for-dell-powerscale-one
r: References: - https://www.dell.com/support/kbdoc/en-us/000224860/dsa-2024-163-security-update-for-dell-powerscale-onefs-for-multiple-security-vulnerabilities
CVE ID: CVE-2024-25970 State: PUBLISHED Published: 2024-05-14T06:53:56.089Z Last Updated: 2024-08-01T23:52:06.490Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: Dell Products: PowerScale OneFS Problem Types: CWE-20 Description: Dell PowerScale OneFS versions 8.2.x through 9.7.0.1 contains an improper input validation vulnerability. A low privileged remote attacker could potentially exploit this vulnerability, leading to loss of integrity. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/en-us/000224860/dsa-2024-163-security-update-for-dell-powerscale-onefs-for-multiple-security-vul
.dell.com/support/kbdoc/en-us/000224860/dsa-2024-163-security-update-for-dell-powerscale-onefs-for-multiple-security-vulnerabilities
CVE ID: CVE-2024-25971 State: PUBLISHED Published: 2024-03-28T18:43:06.075Z Last Updated: 2024-08-01T23:52:06.184Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:L) Vendors: Dell Products: PowerProtect Data Manager Problem Types: CWE-611 Description: Dell PowerProtect Data Manager, version 19.15, contains an XML External Entity Injection vulnerability. A remote high privileged attacker could potentially exploit this vulnerability, leading to information disclosure, denial-of-service. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/en-us/000223556/dsa-2024-132-security-update-dell-power-protect
tainer: References: - https://www.dell.com/support/kbdoc/en-us/000223556/dsa-2024-132-security-update-dell-power-protect-data-manager-for-multiple-security-vulnerabilities
CVE ID: CVE-2024-25972 State: PUBLISHED Published: 2024-03-01T09:31:16.264Z Last Updated: 2024-11-04T19:38:33.616Z Vendors: Zhejiang Uniview Technologies Co.,Ltd and Atsumi Electric Co., Ltd. Products: OET-213H-BTS1 Problem Types: Initialization of a Resource with an Insecure Default Description: Initialization of a resource with an insecure default vulnerability in OET-213H-BTS1 sold in Japan by Atsumi Electric Co., Ltd. allows a network-adjacent unauthenticated attacker to configure and control the affected product. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.atsumi.co.jp/info-20240229.html - https://www.atsumi.co.jp/pdf/oet-213h-bt
Program Container: References: - https://www.atsumi.co.jp/info-20240229.html - https://www.atsumi.co.jp/pdf/oet-213h-bts1.pdf - https://jvn.jp/en/jp/JVN77203800/
CVE ID: CVE-2024-25973 State: PUBLISHED Published: 2024-02-20T08:00:37.226Z Last Updated: 2025-03-14T00:50:42.483Z Vendors: Frentix GmbH Products: OpenOlat LMS Problem Types: CWE-20 Description: The Frentix GmbH OpenOlat LMS is affected by multiple stored Cross-Site Scripting (XSS) vulnerabilities. An attacker with rights to create or edit groups can create a course with a name that contains an XSS payload. Furthermore, attackers with the permissions to create or rename a catalog (sub-category) can enter unfiltered input in the name field. In addition, attackers who are allowed to create curriculums can also enter unfiltered input in the name field. This allows an attacker to execute stored
owed to create curriculums can also enter unfiltered input in the name field. This allows an attacker to execute stored JavaScript code with the permissions of the victim in the context of the user's browser. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://r.sec-consult.com/openolat - http://seclists.org/fulldisclosure/2024/Feb/23
CVE ID: CVE-2024-25974 State: PUBLISHED Published: 2024-02-20T08:02:44.251Z Last Updated: 2025-02-13T17:40:56.325Z Vendors: Frentix GmbH Products: OpenOlat LMS Problem Types: CWE-20 Description: The Frentix GmbH OpenOlat LMS is affected by stored a Cross-Site Scripting (XSS) vulnerability. It is possible to upload files within the Media Center of OpenOlat version 18.1.5 (or lower) as an authenticated user without any other rights. Although the filetypes are limited, an SVG image containing an XSS payload can be uploaded. After a successful upload the file can be shared with groups of users (including admins) who can be attacked with the JavaScript payload. Additional Analyst Notes: - CISA AD
groups of users (including admins) who can be attacked with the JavaScript payload. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://r.sec-consult.com/openolat - http://seclists.org/fulldisclosure/2024/Feb/23
CVE ID: CVE-2024-25975 State: PUBLISHED Published: 2024-05-29T13:13:14.625Z Last Updated: 2025-02-13T17:40:56.941Z Vendors: Interaction Design Team at the University of Applied Sciences and Arts in Hildesheim/Germany Products: HAWKI Problem Types: CWE-73 Description: The application implements an up- and downvote function which alters a value within a JSON file. The POST parameters are not filtered properly and therefore an arbitrary file can be overwritten. The file can be controlled by an authenticated attacker, the content cannot be controlled. It is possible to overwrite all files for which the webserver has write access. It is required to supply a relative path (path traversal). Additio
e all files for which the webserver has write access. It is required to supply a relative path (path traversal). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://r.sec-consult.com/hawki - https://github.com/HAWK-Digital-Environments/HAWKI/commit/146967f3148e92d1640ffebc21d8914e2d7fb3f1 - http://seclists.org/fulldisclosure/2024/May/34
CVE ID: CVE-2024-25976 State: PUBLISHED Published: 2024-05-29T12:22:46.526Z Last Updated: 2025-03-17T20:39:15.968Z Vendors: Interaction Design Team at the University of Applied Sciences and Arts in Hildesheim/Germany Products: HAWKI Problem Types: CWE-79 Description: When LDAP authentication is activated in the configuration it is possible to obtain reflected XSS execution by creating a custom URL that the victim only needs to open in order to execute arbitrary JavaScript code in the victim's browser. This is due to a fault in the file login.php where the content of "$_SERVER['PHP_SELF']" is reflected into the HTML of the website. Hence the attacker does not need a valid account in order to
ER['PHP_SELF']" is reflected into the HTML of the website. Hence the attacker does not need a valid account in order to exploit this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://r.sec-consult.com/hawki - https://github.com/HAWK-Digital-Environments/HAWKI/commit/146967f3148e92d1640ffebc21d8914e2d7fb3f1 - http://seclists.org/fulldisclosure/2024/May/34
CVE ID: CVE-2024-25977 State: PUBLISHED Published: 2024-05-29T12:31:29.973Z Last Updated: 2025-02-13T17:40:58.166Z Vendors: Interaction Design Team at the University of Applied Sciences and Arts in Hildesheim/Germany Products: HAWKI Problem Types: CWE-384 Description: The application does not change the session token when using the login or logout functionality. An attacker can set a session token in the victim's browser (e.g. via XSS) and prompt the victim to log in (e.g. via a redirect to the login page). This results in the victim's account being taken over. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://r.sec-consult.com/hawki - https://
nalyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://r.sec-consult.com/hawki - https://github.com/HAWK-Digital-Environments/HAWKI/commit/146967f3148e92d1640ffebc21d8914e2d7fb3f1 - http://seclists.org/fulldisclosure/2024/May/34
CVE ID: CVE-2024-25978 State: PUBLISHED Published: 2024-02-19T16:31:13.715Z Last Updated: 2024-08-01T23:52:06.392Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Problem Types: CWE-400 Description: Insufficient file size checks resulted in a denial of service risk in the file picker's unzip functionality. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-74641 - https://bugzilla.redhat.com/show_bug.cgi?id=2264074 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KXGBYJ43BUEBUAQZU3DT5I5A3YLF47CB/ - https://moodle.o
.org/archives/list/package-announce@lists.fedoraproject.org/message/KXGBYJ43BUEBUAQZU3DT5I5A3YLF47CB/ - https://moodle.org/mod/forum/discuss.php?d=455634
CVE ID: CVE-2024-25979 State: PUBLISHED Published: 2024-02-19T16:31:34.282Z Last Updated: 2024-08-21T17:43:34.445Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Problem Types: CWE-233 Description: The URL parameters accepted by forum search were not limited to the allowed parameters. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-69774 - https://bugzilla.redhat.com/show_bug.cgi?id=2264095 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KXGBYJ43BUEBUAQZU3DT5I5A3YLF47CB/ - https://moodle.org/mod/forum/discus
package-announce@lists.fedoraproject.org/message/KXGBYJ43BUEBUAQZU3DT5I5A3YLF47CB/ - https://moodle.org/mod/forum/discuss.php?d=455635
CVE ID: CVE-2024-25980 State: PUBLISHED Published: 2024-02-19T16:32:08.068Z Last Updated: 2024-08-01T23:52:06.126Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Problem Types: CWE-284 Description: Separate Groups mode restrictions were not honored in the H5P attempts report, which would display users from other groups. By default this only provided additional access to non-editing teachers. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-80501 - https://bugzilla.redhat.com/show_bug.cgi?id=2264096 - https://lists.fedoraproject.org/archives/list/package-ann
-80501 - https://bugzilla.redhat.com/show_bug.cgi?id=2264096 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KXGBYJ43BUEBUAQZU3DT5I5A3YLF47CB/ - https://moodle.org/mod/forum/discuss.php?d=455636
CVE ID: CVE-2024-25981 State: PUBLISHED Published: 2024-02-19T16:32:28.338Z Last Updated: 2024-08-01T23:52:06.441Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Problem Types: CWE-284 Description: Separate Groups mode restrictions were not honored when performing a forum export, which would export forum data for all groups. By default this only provided additional access to non-editing teachers. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-80504 - https://bugzilla.redhat.com/show_bug.cgi?id=2264097 - https://lists.fedoraproject.org/archives/list/packag
s=MDL-80504 - https://bugzilla.redhat.com/show_bug.cgi?id=2264097 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KXGBYJ43BUEBUAQZU3DT5I5A3YLF47CB/ - https://moodle.org/mod/forum/discuss.php?d=455637
CVE ID: CVE-2024-25982 State: PUBLISHED Published: 2024-02-19T16:32:42.136Z Last Updated: 2025-04-24T15:08:34.553Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Problem Types: CWE-352 Description: The link to update all installed language packs did not include the necessary token to prevent a CSRF risk. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-54749 - https://bugzilla.redhat.com/show_bug.cgi?id=2264098 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KXGBYJ43BUEBUAQZU3DT5I5A3YLF47CB/ - https://moodle.
t.org/archives/list/package-announce@lists.fedoraproject.org/message/KXGBYJ43BUEBUAQZU3DT5I5A3YLF47CB/ - https://moodle.org/mod/forum/discuss.php?d=455638
CVE ID: CVE-2024-25983 State: PUBLISHED Published: 2024-02-19T16:32:58.729Z Last Updated: 2024-08-01T23:52:06.541Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) Problem Types: CWE-639 Description: Insufficient checks in a web service made it possible to add comments to the comments block on another user's dashboard when it was not otherwise available (e.g., on their profile page). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-78300 - https://bugzilla.redhat.com/show_bug.cgi?id=2264099 - https://lists.fedoraproject.org/archives/list/package-announce@lists.f
s://bugzilla.redhat.com/show_bug.cgi?id=2264099 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KXGBYJ43BUEBUAQZU3DT5I5A3YLF47CB/ - https://moodle.org/mod/forum/discuss.php?d=455641
CVE ID: CVE-2024-25984 State: PUBLISHED Published: 2024-03-11T18:55:35.877Z Last Updated: 2024-10-27T00:55:24.268Z Vendors: Google Products: Android Problem Types: Information disclosure Description: In dumpBatteryDefend of dump_power.cpp, there is a possible out of bounds read due to a heap buffer overflow. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://source.android.com/security/bulletin/pixel/2024-03-01
CVE ID: CVE-2024-25985 State: PUBLISHED Published: 2024-03-11T18:55:36.033Z Last Updated: 2024-08-26T16:03:38.604Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In bigo_unlocked_ioctl of bigo.c, there is a possible UAF due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/pixel/2024-03-01
CVE ID: CVE-2024-25986 State: PUBLISHED Published: 2024-03-11T18:55:36.196Z Last Updated: 2024-08-27T20:49:18.226Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In ppmp_unprotect_buf of drm_fw.c, there is a possible compromise of protected memory due to a logic error in the code. This could lead to local escalation of privilege to TEE with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/pixel/2024-03-01
CVE ID: CVE-2024-25987 State: PUBLISHED Published: 2024-03-11T18:55:36.347Z Last Updated: 2024-08-05T17:45:57.248Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In pt_sysctl_command of pt.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/pixel/2024-03-01
CVE ID: CVE-2024-25988 State: PUBLISHED Published: 2024-03-11T18:55:36.494Z Last Updated: 2024-08-27T14:51:42.532Z Vendors: Google Products: Android Problem Types: Information disclosure Description: In SAEMM_DiscloseGuti of SAEMM_RadioMessageCodec.c, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/pixel/2024-03-01
CVE ID: CVE-2024-25989 State: PUBLISHED Published: 2024-03-11T18:55:36.645Z Last Updated: 2024-11-07T21:26:49.127Z Vendors: Google Products: Android Problem Types: Information disclosure Description: In gpu_slc_liveness_update of pixel_gpu_slc.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://source.android.com/security/bulletin/pixel/2024-03-01
CVE ID: CVE-2024-25990 State: PUBLISHED Published: 2024-03-11T18:55:36.797Z Last Updated: 2025-04-16T15:44:51.983Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In pktproc_perftest_gen_rx_packet_sktbuf_mode of link_rx_pktproc.c, there is a possible out of bounds write due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://source.android.com/security/bulletin/pixel/2024-03-01
CVE ID: CVE-2024-25991 State: PUBLISHED Published: 2024-03-11T18:55:36.950Z Last Updated: 2024-11-22T21:10:24.819Z Vendors: Google Products: Android Problem Types: Information disclosure Description: In acpm_tmu_ipc_handler of tmu_plugin.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://source.android.com/security/bulletin/pixel/2024-03-01
CVE ID: CVE-2024-25992 State: PUBLISHED Published: 2024-03-11T18:55:37.104Z Last Updated: 2024-08-28T18:59:35.669Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In tmu_tz_control of tmu.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/pixel/2024-03-01
CVE ID: CVE-2024-25993 State: PUBLISHED Published: 2024-03-11T18:55:37.250Z Last Updated: 2024-08-15T19:18:12.277Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In tmu_reset_tmu_trip_counter of , there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/pixel/2024-03-01
CVE ID: CVE-2024-25994 State: PUBLISHED Published: 2024-03-12T08:10:46.012Z Last Updated: 2025-01-24T06:47:39.754Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: PHOENIX CONTACT Products: CHARX SEC-3000, CHARX SEC-3050, CHARX SEC-3100, CHARX SEC-3150 Problem Types: CWE-434 Description: An unauthenticated remote attacker can upload a arbitrary script file due to improper input validation. The upload destination is fixed and is write only. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cert.vde.com/en/advisories/VDE-2024-011
CVE ID: CVE-2024-25995 State: PUBLISHED Published: 2024-03-12T08:10:58.302Z Last Updated: 2025-01-30T10:48:21.911Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: PHOENIX CONTACT Products: CHARX SEC-3000, CHARX SEC-3050, CHARX SEC-3100, CHARX SEC-3150 Problem Types: CWE-20 Description: An unauthenticated remote attacker can modify configurations to perform a remote code execution, gain root rights or perform an DoS due to improper input validation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cert.vde.com/en/advisories/VDE-2024-011 - https://www.zerodayinitiative.com/advisories/ZDI-24-856/
CVE ID: CVE-2024-25996 State: PUBLISHED Published: 2024-03-12T08:11:08.905Z Last Updated: 2024-08-01T23:52:06.388Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: PHOENIX CONTACT Products: CHARX SEC-3000, CHARX SEC-3050, CHARX SEC-3100, CHARX SEC-3150 Problem Types: CWE-346 Description: An unauthenticated remote attacker can perform a remote code execution due to an origin validation error. The access is limited to the service user. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cert.vde.com/en/advisories/VDE-2024-011
CVE ID: CVE-2024-25997 State: PUBLISHED Published: 2024-03-12T08:11:19.909Z Last Updated: 2024-08-01T23:52:06.435Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: PHOENIX CONTACT Products: CHARX SEC-3000, CHARX SEC-3050, CHARX SEC-3100, CHARX SEC-3150 Problem Types: CWE-20 Description: An unauthenticated remote attacker can perform a log injection due to improper input validation. Only a certain log file is affected. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cert.vde.com/en/advisories/VDE-2024-011