Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
n, a patch is not available but OpenFGA's maintainers are planning a patch for inclusion in a future release. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/openfga/openfga/security/advisories/GHSA-3f6g-m4hr-59h8
CVE ID: CVE-2024-42474 State: PUBLISHED Published: 2024-08-12T17:01:44.557Z Last Updated: 2024-08-12T19:28:13.750Z Severity: MEDIUM (CVSS 5.9 CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N) Vendors: streamlit Products: streamlit Problem Types: CWE-22 Description: Streamlit is a data oriented application development framework for python. Snowflake Streamlit open source addressed a security vulnerability via the static file sharing feature. Users of hosted Streamlit app(s) on Windows were vulnerable to a path traversal vulnerability when the static file sharing feature is enabled. An attacker could utilize the vulnerability to leak the password hash of the Windows user running Streamlit. The vul
ed. An attacker could utilize the vulnerability to leak the password hash of the Windows user running Streamlit. The vulnerability was patched on Jul 25, 2024, as part of Streamlit open source version 1.37.0. The vulnerability only affects Windows. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/streamlit/streamlit/security/advisories/GHSA-rxff-vr5r-8cj5 - https://github.com/streamlit/streamlit/commit/3a639859cfdfba2187c81897d44a3e33825eb0a3
CVE ID: CVE-2024-42475 State: PUBLISHED Published: 2024-08-15T18:40:49.750Z Last Updated: 2024-08-19T19:23:56.720Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: CORDEA Products: oauth Problem Types: CWE-330, CWE-352 Description: In the OAuth library for nim prior to version 0.11, the `state` values generated by the `generateState` function do not have sufficient entropy. These can be successfully guessed by an attacker allowing them to perform a CSRF vs a user, associating the user's session with the attacker's protected resources. While `state` isn't exactly a cryptographic value, it should be generated in a cryptographically secure way. `generateState` s
`state` isn't exactly a cryptographic value, it should be generated in a cryptographically secure way. `generateState` should be using a CSPRNG. Version 0.11 modifies the `generateState` function to generate `state` values of at least 128 bits of entropy while using a CSPRNG. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/CORDEA/oauth/security/advisories/GHSA-332c-q46h-fg8f - https://github.com/CORDEA/oauth/blob/b8c163b0d9cfad6d29ce8c1fb394e5f47182ee1c/src/oauth2.nim#L179
CVE ID: CVE-2024-42476 State: PUBLISHED Published: 2024-08-15T18:48:08.325Z Last Updated: 2024-08-20T15:39:54.912Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: CORDEA Products: oauth Problem Types: CWE-352 Description: In the OAuth library for nim prior to version 0.11, the Authorization Code grant and Implicit grant both rely on the `state` parameter to prevent cross-site request forgery (CSRF) attacks where a resource owner might have their session associated with protected resources belonging to an attacker. When this project is compiled with certain compiler flags set, it is possible that the `state` parameter will not be checked at all, creating a CS
led with certain compiler flags set, it is possible that the `state` parameter will not be checked at all, creating a CSRF vulnerability. Version 0.11 checks the `state` parameter using a regular `if` statement or `doAssert` instead of relying on a plain `assert`. `doAssert` will achieve the desired behavior even if `-d:danger` or `--assertions:off` is set. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/CORDEA/oauth/security/advisories/GHSA-pc9j-53g7-5x54 - https://github.com/CORDEA/oauth/blob/b8c163b0d9cfad6d29ce8c1fb394e5f47182ee1c/src/oauth2.nim#L235 - https://github.com/CORDEA/oauth/blob/b8c163b0d9cfad6d29ce8c1fb394e5f47182ee1c/src/oauth2.nim#L255
CVE ID: CVE-2024-42477 State: PUBLISHED Published: 2024-08-12T15:02:40.980Z Last Updated: 2024-08-13T14:07:30.334Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: ggerganov Products: llama.cpp Problem Types: CWE-125 Description: llama.cpp provides LLM inference in C/C++. The unsafe `type` member in the `rpc_tensor` structure can cause `global-buffer-overflow`. This vulnerability may lead to memory data leakage. The vulnerability is fixed in b3561. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ggerganov/llama.cpp/security/advisories/GHSA-mqp6-7pv6-fqjf - https://github.com/ggerganov/llama.cpp/commit/b72942fac998672a79a1ae
llama.cpp/security/advisories/GHSA-mqp6-7pv6-fqjf - https://github.com/ggerganov/llama.cpp/commit/b72942fac998672a79a1ae3c03b340f7e629980b
CVE ID: CVE-2024-42478 State: PUBLISHED Published: 2024-08-12T15:05:12.697Z Last Updated: 2024-08-16T19:15:15.749Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: ggerganov Products: llama.cpp Problem Types: CWE-125 Description: llama.cpp provides LLM inference in C/C++. The unsafe `data` pointer member in the `rpc_tensor` structure can cause arbitrary address reading. This vulnerability is fixed in b3561. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ggerganov/llama.cpp/security/advisories/GHSA-5vm9-p64x-gqw9 - https://github.com/ggerganov/llama.cpp/commit/b72942fac998672a79a1ae3c03b340f7e629980b
CVE ID: CVE-2024-42479 State: PUBLISHED Published: 2024-08-12T15:07:19.150Z Last Updated: 2024-08-13T13:47:10.838Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: ggerganov Products: llama.cpp Problem Types: CWE-123 Description: llama.cpp provides LLM inference in C/C++. The unsafe `data` pointer member in the `rpc_tensor` structure can cause arbitrary address writing. This vulnerability is fixed in b3561. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ggerganov/llama.cpp/security/advisories/GHSA-wcr5-566p-9cwj - https://github.com/ggerganov/llama.cpp/commit/b72942fac998672a79a1ae3c03b340f7e629980b
CVE ID: CVE-2024-42480 State: PUBLISHED Published: 2024-08-12T15:21:52.010Z Last Updated: 2024-08-12T17:55:54.373Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: clastix Products: kamaji Problem Types: CWE-284 Description: Kamaji is the Hosted Control Plane Manager for Kubernetes. In versions 1.0.0 and earlier, Kamaji uses an "open at the top" range definition in RBAC for etcd roles leading to some TCPs API servers being able to read, write, and delete the data of other control planes. This vulnerability is fixed in edge-24.8.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/clastix/kamaji/security/advisories/GHSA-6r4j-4rj
nalyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/clastix/kamaji/security/advisories/GHSA-6r4j-4rjc-8vw5 - https://github.com/clastix/kamaji/commit/1731e8c2ed5148b125ecfbdf091ee177bd44f3db - https://github.com/clastix/kamaji/blob/8cdc6191242f80d120c46b166e2102d27568225a/internal/datastore/etcd.go#L19-L24
CVE ID: CVE-2024-42481 State: PUBLISHED Published: 2024-08-12T15:30:08.947Z Last Updated: 2024-08-13T14:04:00.621Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: skyportlabs Products: skyportd Problem Types: CWE-400 Description: Skyport Daemon (skyportd) is the daemon for the Skyport Panel. By making thousands of folders & files (easy due to skyport's lack of rate limiting on createFolder. createFile), skyportd in a lot of cases will cause 100% CPU usage and an OOM, probably crashing the system. This is fixed in 0.2.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/skyportlabs/skyportd/security/advisories/GHSA-cwmq-phcx-9g
es: - CISA ADP Vulnrichment: References: - https://github.com/skyportlabs/skyportd/security/advisories/GHSA-cwmq-phcx-9g92
CVE ID: CVE-2024-42482 State: PUBLISHED Published: 2024-08-12T15:35:57.157Z Last Updated: 2024-08-13T17:48:18.971Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: fish-shop Products: syntax-check Problem Types: CWE-140 Description: fish-shop/syntax-check is a GitHub action for syntax checking fish shell files. Improper neutralization of delimiters in the `pattern` input (specifically the command separator `;` and command substitution characters `(` and `)`) mean that arbitrary command injection is possible by modification of the input value used in a workflow. This has the potential for exposure or exfiltration of sensitive information from the workflow runn
used in a workflow. This has the potential for exposure or exfiltration of sensitive information from the workflow runner, such as might be achieved by sending environment variables to an external entity. It is recommended that users update to the patched version `v1.6.12` or the latest release version `v2.0.0`, however remediation may be possible through careful control of workflows and the `pattern` input value used by this action. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/fish-shop/syntax-check/security/advisories/GHSA-xj87-mqvh-88w2 - https://github.com/fish-shop/syntax-check/commit/91e6817c48ad475542fe4e78139029b036a53b03 - https://github.com/f
-88w2 - https://github.com/fish-shop/syntax-check/commit/91e6817c48ad475542fe4e78139029b036a53b03 - https://github.com/fish-shop/syntax-check/commit/c2cb11395e21119ff8d6e7ea050430ee7d6f49ca
CVE ID: CVE-2024-42483 State: PUBLISHED Published: 2024-09-12T14:12:18.128Z Last Updated: 2024-09-12T16:46:16.388Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: espressif Products: esp-now Problem Types: CWE-349 Description: ESP-NOW Component provides a connectionless Wi-Fi communication protocol. An replay attacks vulnerability was discovered in the implementation of the ESP-NOW because the caches is not differentiated by message types, it is a single, shared resource for all kinds of messages, whether they are broadcast or unicast, and regardless of whether they are ciphertext or plaintext. This can result an attacker to clear the cache of its legitimate
regardless of whether they are ciphertext or plaintext. This can result an attacker to clear the cache of its legitimate entries, there by creating an opportunity to re-inject previously captured packets. This vulnerability is fixed in 2.5.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/espressif/esp-now/security/advisories/GHSA-wf6q-c2xr-77xj - https://github.com/espressif/esp-now/commit/4e30db50d541b2909d278ef0db05de1a3d7190ef
CVE ID: CVE-2024-42484 State: PUBLISHED Published: 2024-09-12T14:12:13.174Z Last Updated: 2024-09-12T16:53:05.559Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L) Vendors: espressif Products: esp-now Problem Types: CWE-125 Description: ESP-NOW Component provides a connectionless Wi-Fi communication protocol. An Out-of-Bound (OOB) vulnerability was discovered in the implementation of the ESP-NOW group type message because there is no check for the addrs_num field of the group type message. This can result in memory corruption related attacks. Normally there are two fields in the group information that need to be checked, i.e., the addrs_num field and the addrs_list fi
y there are two fields in the group information that need to be checked, i.e., the addrs_num field and the addrs_list fileld. Since we only checked the addrs_list field, an attacker can send a group type message with an invalid addrs_num field, which will cause the message handled by the firmware to be much larger than the current buffer, thus causing a memory corruption issue that goes beyond the payload length. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/espressif/esp-now/security/advisories/GHSA-q6f6-4qc5-vhx5 - https://github.com/espressif/esp-now/commit/b03a1b4593713fa4bf0038a87edca01f10114a7a
CVE ID: CVE-2024-42485 State: PUBLISHED Published: 2024-08-12T15:39:41.174Z Last Updated: 2024-09-18T15:34:58.289Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: pxlrbt Products: filament-excel Problem Types: CWE-22 Description: Filament Excel enables excel export for Filament admin resources. The export download route `/filament-excel/{path}` allowed downloading any file without login when the webserver allows `../` in the URL. Patched with Version v2.3.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/pxlrbt/filament-excel/security/advisories/GHSA-m3px-vjxr-fx4m - https://github.com/pxlrbt/filament-excel/commit/bda42891a
xlrbt/filament-excel/security/advisories/GHSA-m3px-vjxr-fx4m - https://github.com/pxlrbt/filament-excel/commit/bda42891a4b0c15d5dab5da8c53a006ddadccfb7
CVE ID: CVE-2024-42486 State: PUBLISHED Published: 2024-08-16T14:34:41.560Z Last Updated: 2024-08-16T14:54:16.632Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: cilium Products: cilium Problem Types: CWE-200 Description: Cilium is a networking, observability, and security solution with an eBPF-based dataplane. In versions on the 1.15.x branch prior to 1.15.8 and the 1.16.x branch prior to 1.16.1, ReferenceGrant changes are not correctly propagated in Cilium's GatewayAPI controller, which could lead to Gateway resources being able to access secrets for longer than intended, or to Routes having the ability to forward traffic to backends in other namespaces f
s secrets for longer than intended, or to Routes having the ability to forward traffic to backends in other namespaces for longer than intended. This issue has been patched in Cilium v1.15.8 and v1.16.1. As a workaround, any modification of a related Gateway/HTTPRoute/GRPCRoute/TCPRoute CRD (for example, adding any label to any of these resources) will trigger a reconciliation of ReferenceGrants on an affected cluster. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/cilium/cilium/security/advisories/GHSA-vwf8-q6fw-4wcm - https://github.com/cilium/cilium/pull/34032 - https://github.com/cilium/cilium/commit/ed3dfa0aab8b80f7e841a6d49d2a990ac2dca053
CVE ID: CVE-2024-42487 State: PUBLISHED Published: 2024-08-15T20:26:53.455Z Last Updated: 2024-08-15T20:46:34.910Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N) Vendors: cilium Products: cilium Problem Types: CWE-113 Description: Cilium is a networking, observability, and security solution with an eBPF-based dataplane. In the 1.15 branch prior to 1.15.8 and the 1.16 branch prior to 1.16.1, Gateway API HTTPRoutes and GRPCRoutes do not follow the match precedence specified in the Gateway API specification. In particular, request headers are matched before request methods, when the specification describes that the request methods must be respected before headers are mat
fore request methods, when the specification describes that the request methods must be respected before headers are matched. This could result in unexpected behaviour with security This issue is fixed in Cilium v1.15.8 and v1.16.1. There is no workaround for this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/cilium/cilium/security/advisories/GHSA-qcm3-7879-xcww - https://github.com/cilium/cilium/pull/34109 - https://github.com/cilium/cilium/commit/a3510fe4a92305822aa1a5e08cb6d6c873c8699a
CVE ID: CVE-2024-42488 State: PUBLISHED Published: 2024-08-15T20:36:29.463Z Last Updated: 2024-08-19T19:23:37.503Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: cilium Products: cilium Problem Types: CWE-362 Description: Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.14.14 and 1.15.8, a race condition in the Cilium agent can cause the agent to ignore labels that should be applied to a node. This could in turn cause CiliumClusterwideNetworkPolicies intended for nodes with the ignored label to not apply, leading to policy bypass. This issue has been patched in Cilium v1.14.14 and v1.15.8 As the
ignored label to not apply, leading to policy bypass. This issue has been patched in Cilium v1.14.14 and v1.15.8 As the underlying issue depends on a race condition, users unable to upgrade can restart the Cilium agent on affected nodes until the affected policies are confirmed to be working as expected. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/cilium/cilium/security/advisories/GHSA-q7w8-72mr-vpgw - https://github.com/cilium/cilium/pull/33511 - https://github.com/cilium/cilium/commit/aa44dd148a9be95e07782e4f990e61678ef0abf8
CVE ID: CVE-2024-42489 State: PUBLISHED Published: 2024-08-12T15:49:18.935Z Last Updated: 2024-08-13T20:43:35.138Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: xwikisas Products: xwiki-pro-macros Problem Types: CWE-74 Description: Pro Macros provides XWiki rendering macros. Missing escaping in the Viewpdf macro allows any user with view right on the `CKEditor.HTMLConverter` page or edit or comment right on any page to perform remote code execution. Other macros like Viewppt are vulnerable to the same kind of attack. This vulnerability is fixed in 1.10.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/xwikisas/xwiki-pr
s fixed in 1.10.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/xwikisas/xwiki-pro-macros/security/advisories/GHSA-cfq3-q227-7j65 - https://github.com/xwikisas/xwiki-pro-macros/commit/199553c84901999481a20614f093af2d57970eba - https://github.com/xwikisas/xwiki-pro-macros/blob/main/xwiki-pro-macros-ui/src/main/resources/Confluence/Macros/Viewpdf.xml#L265-L267
CVE ID: CVE-2024-42490 State: PUBLISHED Published: 2024-08-22T15:34:45.815Z Last Updated: 2024-08-22T16:04:32.442Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N) Vendors: goauthentik Products: authentik Problem Types: CWE-285 Description: authentik is an open-source Identity Provider. Several API endpoints can be accessed by users without correct authentication/authorization. The main API endpoints affected by this are /api/v3/crypto/certificatekeypairs/<uuid>/view_certificate/, /api/v3/crypto/certificatekeypairs/<uuid>/view_private_key/, and /api/v3/.../used_by/. Note that all of the affected API endpoints require the knowledge of the ID of an object, which especiall
/.../used_by/. Note that all of the affected API endpoints require the knowledge of the ID of an object, which especially for certificates is not accessible to an unprivileged user. Additionally the IDs for most objects are UUIDv4, meaning they are not easily guessable/enumerable. authentik 2024.4.4, 2024.6.4 and 2024.8.0 fix this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/goauthentik/authentik/security/advisories/GHSA-qxqc-27pr-wgc8 - https://github.com/goauthentik/authentik/commit/19318d4c00bb02c4ec3c4f8f15ac2e1dbe8d846c - https://github.com/goauthentik/authentik/commit/359b343f51524342a5ca03828e7c975a1d654b11
CVE ID: CVE-2024-42491 State: PUBLISHED Published: 2024-09-05T17:17:56.961Z Last Updated: 2025-11-03T22:04:56.291Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H) Vendors: asterisk Products: asterisk Problem Types: CWE-252, CWE-476 Description: Asterisk is an open-source private branch exchange (PBX). Prior to versions 18.24.3, 20.9.3, and 21.4.3 of Asterisk and versions 18.9-cert12 and 20.7-cert2 of certified-asterisk, if Asterisk attempts to send a SIP request to a URI whose host portion starts with `.1` or `[.1]`, and res_resolver_unbound is loaded, Asterisk will crash with a SEGV. To receive a patch, users should upgrade to one of the following versions: 18.24.3,
ed, Asterisk will crash with a SEGV. To receive a patch, users should upgrade to one of the following versions: 18.24.3, 20.9.3, 21.4.3, certified-18.9-cert12, certified-20.7-cert2. Two workarounds are available. Disable res_resolver_unbound by setting `noload = res_resolver_unbound.so` in modules.conf, or set `rewrite_contact = yes` on all PJSIP endpoints. NOTE: This may not be appropriate for all Asterisk configurations. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/asterisk/asterisk/security/advisories/GHSA-v428-g3cw-7hv9 - https://github.com/asterisk/asterisk/commit/42a2f4ccfa2c7062a15063e765916b3332e34cc4 - https://github.co
428-g3cw-7hv9 - https://github.com/asterisk/asterisk/commit/42a2f4ccfa2c7062a15063e765916b3332e34cc4 - https://github.com/asterisk/asterisk/commit/4f01669c7c41c9184f3cce9a3cf1b2ebf6201742 - https://github.com/asterisk/asterisk/commit/50bf8d4d3064930d28ecf1ce3397b14574d514d2 - https://github.com/asterisk/asterisk/commit/7a0090325bfa9d778a39ae5f7d0a98109e4651c8 - https://github.com/asterisk/asterisk/commit/a15050650abf09c10a3c135fab148220cd41d3a0
CVE ID: CVE-2024-42492 State: PUBLISHED Published: 2025-02-12T21:18:57.480Z Last Updated: 2025-02-13T15:18:16.504Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: BIOS and System Firmware Update Package for Intel(R) Server M50FCP family Problem Types: Escalation of Privilege, CWE-427 Description: Uncontrolled search path element in some BIOS and System Firmware Update Package for Intel(R) Server M50FCP family before version R01.02.0002 may allow a privileged user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://intel.com/content/www/us/en/security-center/adv
Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01237.html
CVE ID: CVE-2024-42493 State: PUBLISHED Published: 2024-08-08T17:23:04.770Z Last Updated: 2024-08-09T15:04:20.077Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Dorsett Controls Products: InfoScan Problem Types: CWE-200 Description: Dorsett Controls InfoScan is vulnerable due to a leak of possible sensitive information through the response headers and the rendered JavaScript prior to user login. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-221-01 - https://portal.dtscada.com/#/security-bulletins?bulletin=1
CVE ID: CVE-2024-42494 State: PUBLISHED Published: 2024-12-06T18:05:35.351Z Last Updated: 2024-12-06T20:25:52.000Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Ruijie Products: Reyee OS Problem Types: CWE-359 Description: Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x contains a a feature that could enable sub accounts or attackers to view and exfiltrate sensitive information from all cloud accounts registered to Ruijie's services Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-338-01
CVE ID: CVE-2024-42495 State: PUBLISHED Published: 2024-09-05T22:41:35.315Z Last Updated: 2024-09-06T13:26:24.838Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Hughes Network Systems Products: WL3000 Fusion Software Problem Types: CWE-311 Description: Credentials to access device configuration were transmitted using an unencrypted protocol. These credentials would allow read-only access to network configuration information and terminal configuration data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-249-01