Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
o not expect this vulnerability to have a safety impact. The attack can be automated (AU:Y). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://csirt.divd.nl/DIVD-2024-00035/ - https://csirt.divd.nl/CVE-2024-43663/ - https://iocharger.com
CVE ID: CVE-2024-43683 State: PUBLISHED Published: 2024-10-04T19:56:15.872Z Last Updated: 2024-11-01T15:59:19.229Z Vendors: Microchip Products: TimeProvider 4100 Problem Types: CWE-601 Description: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Microchip TimeProvider 4100 allows XSS Through HTTP Headers.This issue affects TimeProvider 4100: from 1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.microchip.com/en-us/solutions/technologies/embedded-security/how-to-report-potential-product-security-vulnerabilities/timeprovider-4100-grandmaster-improper-verification-of-host-header - https://www.gruppotim.it/it/footer/red-team.html
CVE ID: CVE-2024-43684 State: PUBLISHED Published: 2024-10-04T19:51:51.926Z Last Updated: 2025-08-29T20:11:56.019Z Vendors: Microchip Products: TimeProvider 4100 Problem Types: CWE-352, CWE-79 Description: Cross-Site Request Forgery (CSRF) vulnerability in Microchip TimeProvider 4100 allows Cross Site Request Forgery, Cross-Site Scripting (XSS).This issue affects TimeProvider 4100: from 1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.gruppotim.it/it/footer/red-team.html - https://www.microchip.com/en-us/solutions/technologies/embedded-security/how-to-report-potential-product-security-vulnerabilities/timeprovider-4100-grandmaster-cross-site-request-forgery
CVE ID: CVE-2024-43685 State: PUBLISHED Published: 2024-10-04T19:48:53.595Z Last Updated: 2025-08-29T20:21:47.659Z Vendors: Microchip Products: TimeProvider 4100 Problem Types: CWE-613 Description: Improper Authentication vulnerability in Microchip TimeProvider 4100 (login modules) allows Session Hijacking.This issue affects TimeProvider 4100: from 1.0 before 2.4.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.microchip.com/en-us/solutions/technologies/embedded-security/how-to-report-potential-product-security-vulnerabilities/timeprovider-4100-grandmaster-session-token-fixation - https://www.gruppotim.it/it/footer/red-team.html
CVE ID: CVE-2024-43686 State: PUBLISHED Published: 2024-10-04T19:47:06.117Z Last Updated: 2024-10-07T20:42:38.819Z Vendors: Microchip Products: TimeProvider 4100 Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Microchip TimeProvider 4100 (data plot modules) allows Reflected XSS.This issue affects TimeProvider 4100: from 1.0 before 2.4.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.microchip.com/en-us/solutions/technologies/embedded-security/how-to-report-potential-product-security-vulnerabilities/timeprovider-4100-grandmaster-reflected-xss-vulnerability - https://w
-report-potential-product-security-vulnerabilities/timeprovider-4100-grandmaster-reflected-xss-vulnerability - https://www.gruppotim.it/it/footer/red-team.html
CVE ID: CVE-2024-43687 State: PUBLISHED Published: 2024-10-04T19:41:15.354Z Last Updated: 2025-05-23T15:13:13.627Z Vendors: Microchip Products: TimeProvider 4100 Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Microchip TimeProvider 4100 (banner config modules) allows Cross-Site Scripting (XSS).This issue affects TimeProvider 4100: from 1.0 before 2.4.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.microchip.com/en-us/solutions/technologies/embedded-security/how-to-report-potential-product-security-vulnerabilities/timeprovider-4100-grandmaster-stored-xss-vulnerabili
d-security/how-to-report-potential-product-security-vulnerabilities/timeprovider-4100-grandmaster-stored-xss-vulnerability-in-banner - https://www.gruppotim.it/it/footer/red-team.html
CVE ID: CVE-2024-43688 State: PUBLISHED Published: 2024-08-20T00:00:00 Last Updated: 2024-08-26T13:23:36.277Z Vendors: n/a Products: n/a Problem Types: n/a Description: cron/entry.c in vixie cron before 9cc8ab1, as used in OpenBSD 7.4 and 7.5, allows a heap-based buffer underflow and memory corruption. NOTE: this issue was introduced during a May 2023 refactoring. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.supernetworks.org/advisories/CVE-2024-43688-openbsd-cron-heap-underflow.txt - https://github.com/vixie/cron/commit/9cc8ab1087bb9ab861dd5595c41200683c9f6712 - https://www.supernetworks.org/CVE-2024-43688/openbsd-cron-heap-underflow.txt
CVE ID: CVE-2024-43689 State: PUBLISHED Published: 2024-10-21T01:27:15.253Z Last Updated: 2025-09-04T15:04:43.804Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: ELECOM CO.,LTD. Products: WAB-I1750-PS, WAB-M1775-PS, WAB-S1167-PS, WAB-S1775, WAB-S733MI Problem Types: CWE-121 Description: Stack-based buffer overflow vulnerability exists in ELECOM wireless access points. By processing a specially crafted HTTP request, arbitrary code may be executed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.elecom.co.jp/news/security/20240827-01/ - https://jvn.jp/en/jp/JVN24885537/
CVE ID: CVE-2024-43690 State: PUBLISHED Published: 2024-09-11T04:04:19.129Z Last Updated: 2024-09-11T18:34:36.166Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Gallagher Products: Command Centre Server Problem Types: CWE-829 Description: Inclusion of Functionality from Untrusted Control Sphere(CWE-829) in the Command Centre Server and Workstations may allow an attacker to perform Remote Code Execution (RCE). This issue affects: Command Centre Server and Command Centre Workstations 9.10 prior to vEL9.10.1530 (MR2), 9.00 prior to vEL9.00.2168 (MR4), 8.90 prior to vEL8.90.2155 (MR5), 8.80 prior to vEL8.80.1938 (MR6), all versions of 8.70 and prior. Additional An
(MR4), 8.90 prior to vEL8.90.2155 (MR5), 8.80 prior to vEL8.80.1938 (MR6), all versions of 8.70 and prior. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2024-43690
CVE ID: CVE-2024-43692 State: PUBLISHED Published: 2024-09-24T23:46:12.640Z Last Updated: 2024-09-25T17:00:19.138Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Dover Fueling Solutions (DFS) Products: ProGauge MAGLINK LX CONSOLE, ProGauge MAGLINK LX4 CONSOLE Problem Types: CWE-288 Description: An attacker can directly request the ProGauge MAGLINK LX CONSOLE resource sub page with full privileges by requesting the URL directly. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-268-04
CVE ID: CVE-2024-43693 State: PUBLISHED Published: 2024-09-24T23:50:10.531Z Last Updated: 2024-09-25T16:55:33.557Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Dover Fueling Solutions (DFS) Products: ProGauge MAGLINK LX CONSOLE, ProGauge MAGLINK LX4 CONSOLE Problem Types: CWE-77 Description: A specially crafted POST request to the ProGauge MAGLINK LX CONSOLE UTILITY sub-menu can allow a remote attacker to inject arbitrary commands. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-268-04
CVE ID: CVE-2024-43694 State: PUBLISHED Published: 2024-09-26T17:25:52.840Z Last Updated: 2024-09-26T18:26:54.248Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: goTenna Products: Pro ATAK Plugin Problem Types: CWE-922 Description: In the goTenna Pro ATAK Plugin application, the encryption keys are stored along with a static IV on the device. This allows for complete decryption of keys stored on the device. This allows an attacker to decrypt all encrypted broadcast communications based on broadcast keys stored on the device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-270-05
CVE ID: CVE-2024-43696 State: PUBLISHED Published: 2024-10-08T03:03:41.262Z Last Updated: 2024-10-08T14:02:52.224Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: OpenHarmony Products: OpenHarmony Problem Types: CWE-401 Description: in OpenHarmony v4.1.0 and prior versions allow a local attacker cause DOS by memory leak. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2024/2024-10.md
CVE ID: CVE-2024-43697 State: PUBLISHED Published: 2024-10-08T03:03:46.535Z Last Updated: 2024-10-08T14:02:43.222Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: OpenHarmony Products: OpenHarmony Problem Types: CWE-20 Description: in OpenHarmony v4.1.0 and prior versions allow a local attacker cause DOS through improper input. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2024/2024-10.md
CVE ID: CVE-2024-43698 State: PUBLISHED Published: 2024-10-22T21:23:17.403Z Last Updated: 2024-10-23T14:42:24.238Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Kieback&Peter Products: DDC4040e, DDC4020e, DDC4400e, DDC4200e, DDC4002e, DDC4400, DDC4200-L, DDC4200, DDC4100, DDC4002 Problem Types: CWE-1391 Description: Kieback & Peter's DDC4000 series uses weak credentials, which may allow an unauthenticated attacker to get full admin rights on the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-291-05
CVE ID: CVE-2024-43699 State: PUBLISHED Published: 2024-10-03T22:28:35.364Z Last Updated: 2024-10-04T14:15:27.750Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Delta Electronics Products: DIAEnergie Problem Types: CWE-89 Description: Delta Electronics DIAEnergie is vulnerable to an SQL injection in the script AM_RegReport.aspx. An unauthenticated attacker may be able to exploit this issue to obtain records contained in the targeted product. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-277-03 - https://www.deltaww.com/en-US/Cybersecurity_Advisory
CVE ID: CVE-2024-43700 State: PUBLISHED Published: 2024-08-29T07:36:13.470Z Last Updated: 2024-11-30T12:04:00.620Z Vendors: Philip Hazel Products: xfpt Problem Types: Stack-based buffer overflow Description: xfpt versions prior to 1.01 fails to handle appropriately some parameters inside the input data, resulting in a stack-based buffer overflow vulnerability. When a user of the affected product is tricked to process a specially crafted file, arbitrary code may be executed on the user's environment. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/PhilipHazel/xfpt - https://github.com/PhilipHazel/xfpt/commit/a690304bbd3fd19e9dfdad50
References: - https://github.com/PhilipHazel/xfpt - https://github.com/PhilipHazel/xfpt/commit/a690304bbd3fd19e9dfdad50dcc87ad829f744e4 - https://jvn.jp/en/vu/JVNVU96498690/
CVE ID: CVE-2024-43701 State: PUBLISHED Published: 2024-10-14T08:17:01.686Z Last Updated: 2024-10-15T14:24:07.912Z Vendors: Imagination Technologies Products: Graphics DDK Problem Types: CWE-416, CWE-362 Description: Software installed and run as a non-privileged user may conduct GPU system calls to read and write freed physical memory from the GPU. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.imaginationtech.com/gpu-driver-vulnerabilities
CVE ID: CVE-2024-43702 State: PUBLISHED Published: 2024-11-30T02:30:25.404Z Last Updated: 2024-12-01T23:04:15.021Z Vendors: Imagination Technologies Products: Graphics DDK Problem Types: CWE-280 Description: Software installed and run as a non-privileged user may conduct improper GPU system calls to allow unprivileged access to arbitrary physical memory page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.imaginationtech.com/gpu-driver-vulnerabilities/
CVE ID: CVE-2024-43703 State: PUBLISHED Published: 2024-11-30T02:39:25.336Z Last Updated: 2024-12-01T23:03:00.888Z Vendors: Imagination Technologies Products: Graphics DDK Problem Types: CWE-416 Description: Software installed and run as a non-privileged user may conduct improper GPU system calls to achieve unauthorised reads and writes of physical memory from the GPU HW. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.imaginationtech.com/gpu-driver-vulnerabilities/
CVE ID: CVE-2024-43704 State: PUBLISHED Published: 2024-11-18T04:54:20.225Z Last Updated: 2024-11-18T13:52:26.748Z Vendors: Imagination Technologies Products: Graphics DDK Problem Types: CWE-668 Description: Software installed and run as a non-privileged user may conduct improper GPU system calls to gain access to the graphics buffers of a parent process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.imaginationtech.com/gpu-driver-vulnerabilities/
CVE ID: CVE-2024-43705 State: PUBLISHED Published: 2024-12-28T04:58:08.905Z Last Updated: 2024-12-28T16:38:31.462Z Vendors: Imagination Technologies Products: Graphics DDK Problem Types: CWE-280 Description: Software installed and run as a non-privileged user can trigger the GPU kernel driver to write to arbitrary read-only system files that have been mapped into application memory. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.imaginationtech.com/gpu-driver-vulnerabilities/
CVE ID: CVE-2024-43706 State: PUBLISHED Published: 2025-06-10T16:59:54.945Z Last Updated: 2025-06-10T17:40:30.389Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L) Vendors: Elastic Products: Kibana Problem Types: CWE-285 Description: Improper authorization in Kibana can lead to privilege abuse via a direct HTTP request to a Synthetic monitor endpoint. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://discuss.elastic.co/t/kibana-8-12-1-security-update-esa-2024-21/379064
CVE ID: CVE-2024-43707 State: PUBLISHED Published: 2025-01-23T06:08:10.724Z Last Updated: 2025-01-23T14:47:46.730Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: Elastic Products: Kibana Problem Types: CWE-200 Description: An issue was identified in Kibana where a user without access to Fleet can view Elastic Agent policies that could contain sensitive information. The nature of the sensitive information depends on the integrations enabled for the Elastic Agent and their respective versions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://discuss.elastic.co/t/kibana-8-15-0-security-update-esa-2024-29-esa-2024-30/373521
CVE ID: CVE-2024-43708 State: PUBLISHED Published: 2025-01-23T10:27:30.753Z Last Updated: 2025-02-12T20:41:24.755Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Elastic Products: Kibana Problem Types: CWE-770 Description: An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted payload to a number of inputs in Kibana UI. This can be carried out by users with read access to any feature in Kibana. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://discuss.elastic.co/t/kibana-7-17-23-8-15-0-security-updates-esa-2024-32-esa-2024-33/373548
CVE ID: CVE-2024-43709 State: PUBLISHED Published: 2025-01-21T11:00:11.403Z Last Updated: 2025-02-21T18:03:29.257Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Elastic Products: Elasticsearch Problem Types: CWE-770 Description: An allocation of resources without limits or throttling in Elasticsearch can lead to an OutOfMemoryError exception resulting in a crash via a specially crafted query using an SQL function. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://discuss.elastic.co/t/elasticsearch-7-17-21-and-8-13-3-security-update-esa-2024-25/373442
CVE ID: CVE-2024-43710 State: PUBLISHED Published: 2025-01-23T06:06:38.572Z Last Updated: 2025-01-23T14:48:53.139Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Elastic Products: Kibana Problem Types: CWE-918 Description: A server side request forgery vulnerability was identified in Kibana where the /api/fleet/health_check API could be used to send requests to internal endpoints. Due to the nature of the underlying request, only endpoints available over https that return JSON could be accessed. This can be carried out by users with read access to Fleet. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://discuss.elastic.co/t/kibana-8-1
ccess to Fleet. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://discuss.elastic.co/t/kibana-8-15-0-security-update-esa-2024-29-esa-2024-30/373521
CVE ID: CVE-2024-43712 State: PUBLISHED Published: 2024-12-10T22:04:35.949Z Last Updated: 2024-12-11T16:47:55.698Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Adobe Products: Adobe Experience Manager Problem Types: CWE-79 Description: Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could allow an attacker to execute arbitrary code in the context of the victim's browser. This issue occurs when data from a user-controllable source is improperly sanitized before being used in the Document Object Model (DOM) of a web page, leading to the execution of malicious scripts. Exploitatio
being used in the Document Object Model (DOM) of a web page, leading to the execution of malicious scripts. Exploitation of this issue requires user interaction, such as tricking a victim into clicking a link or navigating to a malicious website. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/experience-manager/apsb24-69.html
CVE ID: CVE-2024-43713 State: PUBLISHED Published: 2024-12-10T22:05:02.851Z Last Updated: 2024-12-11T15:27:50.978Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Adobe Products: Adobe Experience Manager Problem Types: CWE-79 Description: Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by an attacker to execute arbitrary code in the context of the victim's browser session. By manipulating a DOM element through a crafted URL or user input, the attacker can inject malicious scripts that run when the page is rendered. This type of attack requires user interaction,
ttacker can inject malicious scripts that run when the page is rendered. This type of attack requires user interaction, as the victim would need to access a manipulated URL or page with the malicious script. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/experience-manager/apsb24-69.html
CVE ID: CVE-2024-43714 State: PUBLISHED Published: 2024-12-10T22:03:51.277Z Last Updated: 2024-12-11T17:08:29.984Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Adobe Products: Adobe Experience Manager Problem Types: CWE-79 Description: Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by an attacker to execute arbitrary code in the context of the victim's browser session. By manipulating a DOM element through a crafted URL or user input, the attacker can inject malicious scripts that run when the page is rendered. This type of attack requires user interaction,
ttacker can inject malicious scripts that run when the page is rendered. This type of attack requires user interaction, as the victim would need to visit a malicious link or input data into a vulnerable page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/experience-manager/apsb24-69.html
CVE ID: CVE-2024-43715 State: PUBLISHED Published: 2024-12-10T22:05:02.078Z Last Updated: 2024-12-11T14:41:18.310Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Adobe Products: Adobe Experience Manager Problem Types: CWE-79 Description: Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by an attacker to execute arbitrary code in the context of the victim's browser session. By manipulating a DOM element through a crafted URL or user input, the attacker can inject malicious scripts that run when the page is rendered. This type of attack requires user interaction,
ttacker can inject malicious scripts that run when the page is rendered. This type of attack requires user interaction, as the victim would need to visit a malicious link or input data into a compromised form. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/experience-manager/apsb24-69.html
CVE ID: CVE-2024-43716 State: PUBLISHED Published: 2024-12-10T22:03:47.647Z Last Updated: 2025-01-07T17:35:03.374Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Adobe Products: Adobe Experience Manager Problem Types: CWE-284 Description: Adobe Experience Manager versions 6.5.21 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and have a low impact on confidentiality. Exploitation of this issue does not require user interaction. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://hel
is issue does not require user interaction. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/experience-manager/apsb24-69.html
CVE ID: CVE-2024-43717 State: PUBLISHED Published: 2024-12-10T22:05:01.264Z Last Updated: 2025-01-07T17:36:26.167Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Adobe Products: Adobe Experience Manager Problem Types: CWE-284 Description: Adobe Experience Manager versions 6.5.21 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and have a low impact on confidentiality. Exploitation of this issue does not require user interaction. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://hel
CVE ID: CVE-2024-43718 State: PUBLISHED Published: 2024-12-10T22:04:47.076Z Last Updated: 2024-12-11T14:42:33.605Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Adobe Products: Adobe Experience Manager Problem Types: CWE-79 Description: Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/secur
ing the vulnerable field. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/experience-manager/apsb24-69.html