Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
n private instances. A fix has been released in version 6.0.12. As a workaround, one might be able to disable `/proxy` endpoint entirely via, for example, nginx. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/cBioPortal/cbioportal/security/advisories/GHSA-9h44-r3c3-q7rm - https://github.com/cBioPortal/cbioportal/pull/10884 - https://github.com/cBioPortal/cbioportal/commit/ea8642fdbda2d61d2ab34b9da7a1594680bbbcd5 - https://github.com/cBioPortal/cbioportal/releases/tag/v6.0.12 - https://www.wizlynxgroup.com/security-research-advisories/vuln/WLX-2024-004
CVE ID: CVE-2024-41670 State: PUBLISHED Published: 2024-07-26T14:46:14.226Z Last Updated: 2024-08-02T04:46:52.667Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: 202ecommerce Products: paypal Problem Types: CWE-285, CWE-863 Description: In the module "PayPal Official" for PrestaShop 7+ releases prior to version 6.4.2 and for PrestaShop 1.6 releases prior to version 3.18.1, a malicious customer can confirm an order even if payment is finally declined by PayPal. A logical weakness during the capture of a payment in case of disabled webhooks can be exploited to create an accepted order. This could allow a threat actor to confirm an order with a fraudulent paymen
n be exploited to create an accepted order. This could allow a threat actor to confirm an order with a fraudulent payment support. Versions 6.4.2 and 3.18.1 contain a patch for the issue. Additionally, users enable webhooks and check they are callable. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/202ecommerce/paypal/security/advisories/GHSA-w3w3-j3mh-3354
CVE ID: CVE-2024-41671 State: PUBLISHED Published: 2024-07-29T14:37:08.484Z Last Updated: 2025-11-03T22:00:59.620Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L) Vendors: twisted Products: twisted Problem Types: CWE-444 Description: Twisted is an event-based framework for internet applications, supporting Python 3.6+. The HTTP 1.0 and 1.1 server provided by twisted.web could process pipelined HTTP requests out-of-order, possibly resulting in information disclosure. This vulnerability is fixed in 24.7.0rc1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/twisted/twisted/security/advisories/GHSA-c8m8-j448-xjx7
ainer: - CISA ADP Vulnrichment: References: - https://github.com/twisted/twisted/security/advisories/GHSA-c8m8-j448-xjx7 - https://github.com/twisted/twisted/commit/046a164f89a0f08d3239ecebd750360f8914df33 - https://github.com/twisted/twisted/commit/4a930de12fb67e88fefcb8822104152f42b27abc
CVE ID: CVE-2024-41672 State: PUBLISHED Published: 2024-07-24T17:47:20.626Z Last Updated: 2024-08-02T04:46:52.916Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: duckdb Products: duckdb Problem Types: CWE-200 Description: DuckDB is a SQL database management system. In versions 1.0.0 and prior, content in filesystem is accessible for reading using `sniff_csv`, even with `enable_external_access=false`. This vulnerability provides an attacker with access to filesystem even when access is expected to be disabled and other similar functions do NOT provide access. There seem to be two vectors to this vulnerability. First, access to files that should otherwise not b
T provide access. There seem to be two vectors to this vulnerability. First, access to files that should otherwise not be allowed. Second, the content from a file can be read (e.g. `/etc/hosts`, `proc/self/environ`, etc) even though that doesn't seem to be the intent of the sniff_csv function. A fix for this issue is available in commit c9b7c98aa0e1cd7363fe8bb8543a95f38e980d8a and is expected to be part of version 1.1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/duckdb/duckdb/security/advisories/GHSA-w2gf-jxc9-pf2q - https://github.com/duckdb/duckdb/pull/13133 - https://github.com/duckdb/duckdb/commit/c9b7c98aa0e1cd7363fe8bb8
c9-pf2q - https://github.com/duckdb/duckdb/pull/13133 - https://github.com/duckdb/duckdb/commit/c9b7c98aa0e1cd7363fe8bb8543a95f38e980d8a
CVE ID: CVE-2024-41673 State: PUBLISHED Published: 2024-10-01T14:58:34.521Z Last Updated: 2024-10-01T17:47:27.814Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N) Vendors: decidim Products: decidim Problem Types: CWE-79 Description: Decidim is a participatory democracy framework. The version control feature used in resources is subject to potential XSS attack through a malformed URL. This vulnerability is fixed in 0.27.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/decidim/decidim/security/advisories/GHSA-cc4g-m3g7-xmw8 - https://github.com/decidim/decidim/commit/8a18c8b1ee85a1b35ee0d8d5893f218695d15637
CVE ID: CVE-2024-41674 State: PUBLISHED Published: 2024-08-21T14:31:26.240Z Last Updated: 2024-08-21T15:32:22.705Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: ckan Products: ckan Problem Types: CWE-209 Description: CKAN is an open-source data management system for powering data hubs and data portals. If there were connection issues with the Solr server, the internal Solr URL (potentially including credentials) could be leaked to package_search calls as part of the returned error message. This has been patched in CKAN 2.10.5 and 2.11.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ckan/ckan/security/advisories/GHSA-2
Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ckan/ckan/security/advisories/GHSA-2rqw-cfhc-35fh - https://github.com/ckan/ckan/commit/f6b032cd7082d784938165bbd113557639002ca7
CVE ID: CVE-2024-41675 State: PUBLISHED Published: 2024-08-21T14:34:31.424Z Last Updated: 2024-08-22T13:35:13.240Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N) Vendors: ckan Products: ckan Problem Types: CWE-79 Description: CKAN is an open-source data management system for powering data hubs and data portals. The Datatables view plugin did not properly escape record data coming from the DataStore, leading to a potential XSS vector. Sites running CKAN >= 2.7.0 with the datatables_view plugin activated. This is a plugin included in CKAN core, that not activated by default but it is widely used to preview tabular data. This vulnerability has been fixed in CKAN 2.10.5
not activated by default but it is widely used to preview tabular data. This vulnerability has been fixed in CKAN 2.10.5 and 2.11.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ckan/ckan/security/advisories/GHSA-r3jc-vhf4-6v32 - https://github.com/ckan/ckan/commit/9e89ce8220ab1445e0bd85a67994a51d9d3d2688 - https://github.com/ckan/ckan/commit/d7dfe8c427b1c63c75d788a609f3b7d7620a25a1
CVE ID: CVE-2024-41676 State: PUBLISHED Published: 2024-07-29T14:46:26.806Z Last Updated: 2024-08-02T04:46:52.910Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:N) Vendors: OpenMage Products: magento-lts Problem Types: CWE-79 Description: Magento-lts is a long-term support alternative to Magento Community Edition (CE). This XSS vulnerability affects the design/header/welcome, design/header/logo_src, design/header/logo_src_small, and design/header/logo_alt system configs.They are intended to enable admins to set a text in the two cases, and to define an image url for the other two cases. But because of previously missing escaping allowed to input arbitrary html and as
an image url for the other two cases. But because of previously missing escaping allowed to input arbitrary html and as a consequence also arbitrary JavaScript. The problem is patched with Version 20.10.1 or higher. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/OpenMage/magento-lts/security/advisories/GHSA-5vrp-638w-p8m2 - https://github.com/OpenMage/magento-lts/commit/484cf8afc550e98bbf2c03fbb29a8450a32e7948
CVE ID: CVE-2024-41677 State: PUBLISHED Published: 2024-08-06T17:52:14.648Z Last Updated: 2024-08-08T19:04:29.078Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: QwikDev Products: qwik Problem Types: CWE-79 Description: Qwik is a performance focused javascript framework. A potential mutation XSS vulnerability exists in Qwik for versions up to but not including 1.6.0. Qwik improperly escapes HTML on server-side rendering. It converts strings according to the rules found in the `render-ssr.ts` file. It sometimes causes the situation that the final DOM tree rendered on browsers is different from what Qwik expects on server-side rendering. This may be leveraged
final DOM tree rendered on browsers is different from what Qwik expects on server-side rendering. This may be leveraged to perform XSS attacks, and a type of the XSS is known as mXSS (mutation XSS). This has been resolved in qwik version 1.6.0 and @builder.io/qwik version 1.7.3. All users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/QwikDev/qwik/security/advisories/GHSA-2rwj-7xq8-4gx4 - https://github.com/QwikDev/qwik/commit/7e742eb3a1001542d795776c0317d47df8b9d64e - https://github.com/QwikDev/qwik/blob/v1.5.5/packages/qwik/src/core/render/ssr/render-ssr.ts#L1182-L1208
CVE ID: CVE-2024-41678 State: PUBLISHED Published: 2024-11-15T18:08:46.836Z Last Updated: 2024-11-15T18:21:52.262Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: glpi-project Products: glpi Problem Types: CWE-79 Description: GLPI is a free asset and IT management software package. An unauthenticated user can provide a malicious link to a GLPI technician in order to exploit a reflected XSS vulnerability. Upgrade to 10.0.17. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/glpi-project/glpi/security/advisories/GHSA-xwmx-mmrf-hqf9
CVE ID: CVE-2024-41679 State: PUBLISHED Published: 2024-11-15T18:20:44.135Z Last Updated: 2024-11-15T18:41:51.784Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: glpi-project Products: glpi Problem Types: CWE-89 Description: GLPI is a free asset and IT management software package. An authenticated user can exploit a SQL injection vulnerability from the ticket form. Upgrade to 10.0.17. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/glpi-project/glpi/security/advisories/GHSA-hq9q-jfhp-qqgm
CVE ID: CVE-2024-41681 State: PUBLISHED Published: 2024-08-13T07:54:18.686Z Last Updated: 2024-08-13T13:50:59.341Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: Location Intelligence family Problem Types: CWE-326 Description: A vulnerability has been identified in Location Intelligence family (All versions < V4.4). The web server of affected products is configured to support weak ciphers by default. This could allow an unauthenticated attacker in an on-path position to to read and modify any data passed over the connection between legitimate clients and the affected device. Additional Analyst Notes: - CISA ADP Vulnrichment:
r the connection between legitimate clients and the affected device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-720392.html
CVE ID: CVE-2024-41682 State: PUBLISHED Published: 2024-08-13T07:54:19.932Z Last Updated: 2024-08-13T17:54:30.651Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C) Vendors: Siemens Products: Location Intelligence family Problem Types: CWE-307 Description: A vulnerability has been identified in Location Intelligence family (All versions < V4.4). Affected products do not properly enforce restriction of excessive authentication attempts. This could allow an unauthenticated remote attacker to conduct brute force attacks against legitimate user passwords. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productc
ser passwords. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-720392.html
CVE ID: CVE-2024-41683 State: PUBLISHED Published: 2024-08-13T07:54:21.192Z Last Updated: 2024-08-13T13:22:32.419Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C) Vendors: Siemens Products: Location Intelligence family Problem Types: CWE-521 Description: A vulnerability has been identified in Location Intelligence family (All versions < V4.4). Affected products do not properly enforce a strong user password policy. This could facilitate a brute force attack against legitimate user passwords. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-720392.html
CVE ID: CVE-2024-41684 State: PUBLISHED Published: 2024-07-26T11:34:53.978Z Last Updated: 2024-08-02T04:46:52.723Z Vendors: SyroTech Products: SyroTech SY-GPON-1110-WDONT router Problem Types: CWE-614 Description: This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to missing secure flag for the session cookies associated with the router's web management interface. An attacker with remote access could exploit this by intercepting transmission within an HTTP session on the vulnerable system. Successful exploitation of this vulnerability could allow the attacker to capture cookies and compromise the targeted system. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Progr
er to capture cookies and compromise the targeted system. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0225
CVE ID: CVE-2024-41685 State: PUBLISHED Published: 2024-07-26T11:41:53.968Z Last Updated: 2024-08-02T04:46:52.672Z Vendors: SyroTech Products: SyroTech SY-GPON-1110-WDONT router Problem Types: CWE-1004 Description: This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to missing HTTPOnly flag for the session cookies associated with the router's web management interface. An attacker with remote access could exploit this by intercepting transmission within an HTTP session on the vulnerable system. Successful exploitation of this vulnerability could allow the attacker to capture cookies and obtain sensitive information on the targeted system. Additional Analyst Notes: - CISA ADP V
acker to capture cookies and obtain sensitive information on the targeted system. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0225
CVE ID: CVE-2024-41686 State: PUBLISHED Published: 2024-07-26T11:45:18.109Z Last Updated: 2024-08-02T04:46:52.678Z Vendors: SyroTech Products: SyroTech SY-GPON-1110-WDONT router Problem Types: CWE-179 Description: This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to improper implementation of password policies. A local attacker could exploit this by creating password that do not adhere to the defined security standards/policy on the vulnerable system. Successful exploitation of this vulnerability could allow the attacker to expose the router to potential security threats. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.c
ecurity threats. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0225
CVE ID: CVE-2024-41687 State: PUBLISHED Published: 2024-07-26T11:50:30.359Z Last Updated: 2024-08-07T18:59:05.323Z Vendors: SyroTech Products: SyroTech SY-GPON-1110-WDONT router Problem Types: CWE-319 Description: This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to transmission of password in plain text. A remote attacker could exploit this vulnerability by intercepting transmission within an HTTP session on the vulnerable system. Successful exploitation of this vulnerability could allow the attacker to gain unauthorized access to the targeted system. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.cert-in.org.in/s2cMai
itional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0225
CVE ID: CVE-2024-41688 State: PUBLISHED Published: 2024-07-26T11:56:03.174Z Last Updated: 2024-08-02T04:46:52.664Z Vendors: SyroTech Products: SyroTech SY-GPON-1110-WDONT router Problem Types: CWE-312 Description: This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due lack of encryption in storing of usernames and passwords within the router's firmware/ database. An attacker with physical access could exploit this by extracting the firmware and reverse engineer the binary data to access the plaintext credentials on the vulnerable system. Successful exploitation of this vulnerability could allow the attacker to gain unauthorized access to the targeted system. Additional Analyst N
of this vulnerability could allow the attacker to gain unauthorized access to the targeted system. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0225
CVE ID: CVE-2024-41689 State: PUBLISHED Published: 2024-07-26T11:59:38.725Z Last Updated: 2024-08-02T04:46:52.664Z Vendors: SyroTech Products: SyroTech SY-GPON-1110-WDONT router Problem Types: CWE-798 Description: This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to unencrypted storing of WPA/ WPS credentials within the router's firmware/ database. An attacker with physical access could exploit this by extracting the firmware and reverse engineer the binary data to access the plaintext WPA/ WPS credentials on the vulnerable system. Successful exploitation of this vulnerability could allow the attacker to bypass WPA/ WPS and gain access to the Wi-Fi network of the targeted s
of this vulnerability could allow the attacker to bypass WPA/ WPS and gain access to the Wi-Fi network of the targeted system. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0225
CVE ID: CVE-2024-41690 State: PUBLISHED Published: 2024-07-26T12:02:29.466Z Last Updated: 2024-08-02T04:46:52.684Z Vendors: SyroTech Products: SyroTech SY-GPON-1110-WDONT router Problem Types: CWE-312 Description: This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to storing of default username and password credentials in plaintext within the router's firmware/ database. An attacker with physical access could exploit this by extracting the firmware and reverse engineer the binary data to access the plaintext default credentials on the vulnerable system. Successful exploitation of this vulnerability could allow the attacker to gain unauthorized access to the targeted system.
cessful exploitation of this vulnerability could allow the attacker to gain unauthorized access to the targeted system. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0225
CVE ID: CVE-2024-41691 State: PUBLISHED Published: 2024-07-26T12:06:39.053Z Last Updated: 2024-08-05T10:24:12.860Z Vendors: SyroTech Products: SyroTech SY-GPON-1110-WDONT router Problem Types: CWE-312 Description: This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to storing of FTP credentials in plaintext within the SquashFS-root filesystem associated with the router's firmware. An attacker with physical access could exploit this by extracting the firmware and reverse engineer the binary data to access the plaintext FTP credentials from the vulnerable system. Successful exploitation of this vulnerability could allow the attacker to gain unauthorized access to the FTP server
em. Successful exploitation of this vulnerability could allow the attacker to gain unauthorized access to the FTP server associated with the targeted system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0225
CVE ID: CVE-2024-41692 State: PUBLISHED Published: 2024-07-26T12:11:27.774Z Last Updated: 2024-08-02T04:46:52.682Z Vendors: SyroTech Products: SyroTech SY-GPON-1110-WDONT router Problem Types: CWE-1191 Description: This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to presence of root terminal access on a serial interface without proper access control. An attacker with physical access could exploit this by accessing the root shell on the vulnerable system. Successful exploitation of this vulnerability could allow the attacker to execute arbitrary commands with root privileges on the targeted system. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container:
ith root privileges on the targeted system. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0225
CVE ID: CVE-2024-41693 State: PUBLISHED Published: 2024-07-30T08:28:22.959Z Last Updated: 2024-08-02T04:46:52.662Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Mashov Products: Mashov Problem Types: CWE-80 Description: Mashov - CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.gov.il/en/Departments/faq/cve_advisories
CVE ID: CVE-2024-41694 State: PUBLISHED Published: 2024-07-30T09:01:27.183Z Last Updated: 2024-08-02T04:46:52.928Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Cybonet Products: PineApp Mail Relay Problem Types: CWE-200 Description: Cybonet - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.gov.il/en/Departments/faq/cve_advisories
CVE ID: CVE-2024-41695 State: PUBLISHED Published: 2024-07-30T09:02:21.051Z Last Updated: 2024-08-02T04:46:52.934Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Cybonet Products: PineApp Mail Relay Problem Types: CWE-22 Description: Cybonet - CWE-22: Improper Limitation of a Pathname to a Restricted Directory Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.gov.il/en/Departments/faq/cve_advisories
CVE ID: CVE-2024-41696 State: PUBLISHED Published: 2024-07-30T09:09:11.086Z Last Updated: 2024-08-02T04:46:52.667Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Priority Products: PRI WEB Portal Add-On for Priority ERP on prem Problem Types: CWE-200 Description: Priority PRI WEB Portal Add-On for Priority ERP on prem - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.gov.il/en/Departments/faq/cve_advisories
CVE ID: CVE-2024-41697 State: PUBLISHED Published: 2024-08-20T11:48:28.442Z Last Updated: 2024-08-20T13:31:56.603Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Priority Products: Priority Problem Types: CWE-80 Description: Priority - CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.gov.il/en/Departments/faq/cve_advisories