Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-37163 State: PUBLISHED Published: 2024-06-07T16:09:07.437Z Last Updated: 2024-08-02T03:50:54.803Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H) Vendors: oslabs-beta Products: SkyScraper Problem Types: CWE-319 Description: SkyScrape is a GUI Dashboard for AWS Infrastructure and Managing Resources and Usage Costs. SkyScrape's API requests are currently unsecured HTTP requests, leading to potential vulnerabilities for the user's temporary credentials and data. This affects version 1.0.0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/oslabs-beta/SkyScraper/security/advisories/GHSA-vfqg-qhm5
ent: - CVE Program Container: References: - https://github.com/oslabs-beta/SkyScraper/security/advisories/GHSA-vfqg-qhm5-5m3j
CVE ID: CVE-2024-37164 State: PUBLISHED Published: 2024-06-13T14:10:16.920Z Last Updated: 2024-08-02T03:50:54.673Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:N) Vendors: cvat-ai Products: cvat Problem Types: CWE-918 Description: Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. CVAT allows users to supply custom endpoint URLs for cloud storages based on Amazon S3 and Azure Blob Storage. Starting in version 2.1.0 and prior to version 2.14.3, an attacker with a CVAT account can exploit this feature by specifying URLs whose host part is an intranet IP address or an internal domain name. By doing this, the attac
eature by specifying URLs whose host part is an intranet IP address or an internal domain name. By doing this, the attacker may be able to probe the network that the CVAT backend runs in for HTTP(S) servers. In addition, if there is a web server on this network that is sufficiently API-compatible with an Amazon S3 or Azure Blob Storage endpoint, and either allows anonymous access, or allows authentication with credentials that are known by the attacker, then the attacker may be able to create a cloud storage linked to this server. They may then be able to list files on the server; extract files from the server, if these files are of a type that CVAT supports reading from cloud storage (media
server; extract files from the server, if these files are of a type that CVAT supports reading from cloud storage (media data (such as images/videos/archives), importable annotations or datasets, task/project backups); and/or overwrite files on this server with exported annotations/datasets/backups. The exact capabilities of the attacker will depend on how the internal server is configured. Users should upgrade to CVAT 2.14.3 to receive a patch. In this release, the existing SSRF mitigation measures are applied to requests to cloud providers, with access to intranet IP addresses prohibited by default. Some workarounds are also available. One may use network security solutions such as virtual
esses prohibited by default. Some workarounds are also available. One may use network security solutions such as virtual networks or firewalls to prohibit network access from the CVAT backend to unrelated servers on your internal network and/or require authentication for access to internal servers. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/cvat-ai/cvat/security/advisories/GHSA-q684-4jjh-83g6 - https://github.com/cvat-ai/cvat/commit/f2346934c80bd91740f55c2788ef7d535a291d4c
CVE ID: CVE-2024-37165 State: PUBLISHED Published: 2024-07-30T14:10:24.804Z Last Updated: 2024-08-02T03:50:55.188Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: discourse Products: discourse Problem Types: CWE-79 Description: Discourse is an open source discussion platform. Prior to 3.2.3 and 3.3.0.beta3, improperly sanitized Onebox data could lead to an XSS vulnerability in some situations. This vulnerability only affects Discourse instances which have disabled the default Content Security Policy. This vulnerability is fixed in 3.2.3 and 3.3.0.beta3. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.c
3.3.0.beta3. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/discourse/discourse/security/advisories/GHSA-cx83-5p6x-9qh9 - https://github.com/discourse/discourse/commit/26aef0c288839378b9de5819e96eac8cf4ea60fd - https://github.com/discourse/discourse/commit/311b737c910cf0a69f61e1b8bc0b78374b6619d2
CVE ID: CVE-2024-37166 State: PUBLISHED Published: 2024-06-10T21:29:28.578Z Last Updated: 2024-08-02T03:50:54.682Z Severity: HIGH (CVSS 8.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L) Vendors: gurgunday Products: ghtml Problem Types: CWE-79, CWE-80 Description: ghtml is software that uses tagged templates for template engine functionality. It is possible to introduce user-controlled JavaScript code and trigger a Cross-Site Scripting (XSS) vulnerability in some cases. Version 2.0.0 introduces changes to mitigate this issue. Version 2.0.0 contains updated documentation to clarify that while ghtml escapes characters with special meaning in HTML, it does not provide comprehensive protection ag
larify that while ghtml escapes characters with special meaning in HTML, it does not provide comprehensive protection against all types of XSS attacks in every scenario. This aligns with the approach taken by other template engines. Developers should be cautious and take additional measures to sanitize user input and prevent potential vulnerabilities. Additionally, the backtick character (`) is now also escaped to prevent the creation of strings in most cases where a malicious actor somehow gains the ability to write JavaScript. This does not provide comprehensive protection either. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/g
n either. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/gurgunday/ghtml/security/advisories/GHSA-vvhj-v88f-5gxr - https://github.com/gurgunday/ghtml/commit/df1ea50fe8968a766fd2b9379a8f9806375227f8
CVE ID: CVE-2024-37167 State: PUBLISHED Published: 2024-06-25T19:28:32.858Z Last Updated: 2024-08-02T03:50:54.709Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Enalean Products: tuleap Problem Types: CWE-285 Description: Tuleap is an Open Source Suite to improve management of software developments and collaboration. Users are able to see backlog items that they should not see. This issue has been patched in Tuleap Community Edition version 15.9.99.97. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/Enalean/tuleap/security/advisories/GHSA-4c9f-284j-phvj - https://github.com/Enalean/tuleap/commit/
- https://github.com/Enalean/tuleap/security/advisories/GHSA-4c9f-284j-phvj - https://github.com/Enalean/tuleap/commit/13eec93a353d2daf47bb8b9c548cc02f78b93a5e - https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=13eec93a353d2daf47bb8b9c548cc02f78b93a5e - https://tuleap.net/plugins/tracker/?aid=38297
CVE ID: CVE-2024-37168 State: PUBLISHED Published: 2024-06-10T21:32:06.403Z Last Updated: 2024-08-02T03:50:55.550Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: grpc Products: grpc-node Problem Types: CWE-789 Description: @grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to versions 1.10.9, 1.9.15, and 1.8.22, there are two separate code paths in which memory can be allocated per message in excess of the `grpc.max_receive_message_length` channel option: If an incoming message has a size on the wire greater than the configured limit, the entire message is buffered before it is discarded; and/or if an in
ze on the wire greater than the configured limit, the entire message is buffered before it is discarded; and/or if an incoming message has a size within the limit on the wire but decompresses to a size greater than the limit, the entire message is decompressed into memory, and on the server is not discarded. This has been patched in versions 1.10.9, 1.9.15, and 1.8.22. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/grpc/grpc-node/security/advisories/GHSA-7v5v-9h63-cj86 - https://github.com/grpc/grpc-node/commit/08b0422dae56467ecae1007e899efe66a8c4a650 - https://github.com/grpc/grpc-node/commit/674f4e351a619fd4532f84ae6dff96b8ee4e1
8b0422dae56467ecae1007e899efe66a8c4a650 - https://github.com/grpc/grpc-node/commit/674f4e351a619fd4532f84ae6dff96b8ee4e1ed3 - https://github.com/grpc/grpc-node/commit/a8a020339c7eab1347a343a512ad17a4aea4bfdb
CVE ID: CVE-2024-37169 State: PUBLISHED Published: 2024-06-10T21:35:38.198Z Last Updated: 2024-08-02T03:50:55.256Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: jasonraimondi Products: url-to-png Problem Types: CWE-22 Description: @jmondi/url-to-png is a self-hosted URL to PNG utility. Versions prior to 2.0.3 are vulnerable to arbitrary file read if a threat actor uses the Playright's screenshot feature to exploit the file wrapper. Version 2.0.3 mitigates this issue by requiring input URLs to be of protocol `http` or `https`. No known workarounds are available aside from upgrading. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container:
karounds are available aside from upgrading. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/jasonraimondi/url-to-png/security/advisories/GHSA-665w-mwrr-77q3 - https://github.com/jasonraimondi/url-to-png/issues/47 - https://github.com/jasonraimondi/url-to-png/commit/9336020c5e603323f5cf4a2ac3bb9a7735cf61f7 - https://github.com/jasonraimondi/url-to-png/releases/tag/v2.0.3 - https://github.com/user-attachments/files/15536336/Arbitrary.File.Read.via.Playwright.s.Screenshot.Feature.Exploiting.File.Wrapper.pdf
CVE ID: CVE-2024-37171 State: PUBLISHED Published: 2024-07-09T04:21:21.292Z Last Updated: 2024-08-02T03:50:54.664Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) Vendors: SAP_SE Products: SAP Transportation Management (Collaboration Portal) Problem Types: CWE-918 Description: SAP Transportation Management (Collaboration Portal) allows an attacker with non-administrative privileges to send a crafted request from a vulnerable web application. This will trigger the application handler to send a request to an unintended service, which may reveal information about that service. The information obtained could be used to target internal systems behind firewalls that are norm
ion about that service. The information obtained could be used to target internal systems behind firewalls that are normally inaccessible to an attacker from the external network, resulting in a Server-Side Request Forgery vulnerability. There is no effect on integrity or availability of the application. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://url.sap/sapsecuritypatchday - https://me.sap.com/notes/3469958
CVE ID: CVE-2024-37172 State: PUBLISHED Published: 2024-07-09T04:15:22.833Z Last Updated: 2024-08-02T03:50:54.731Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L) Vendors: SAP_SE Products: SAP S/4HANA Finance (Advanced Payment Management) Problem Types: CWE-862 Description: SAP S/4HANA Finance (Advanced Payment Management) does not perform necessary authorization check for an authenticated user, resulting in escalation of privileges. As a result, it has a low impact to confidentiality and availability but there is no impact on the integrity. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://url.sap/sapsecuritypatchday -
nal Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://url.sap/sapsecuritypatchday - https://me.sap.com/notes/3457354
CVE ID: CVE-2024-37173 State: PUBLISHED Published: 2024-07-09T03:57:15.928Z Last Updated: 2024-08-02T03:50:54.682Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: SAP_SE Products: SAP CRM WebClient UI Problem Types: CWE-79 Description: Due to insufficient input validation, SAP CRM WebClient UI allows an unauthenticated attacker to craft a URL link which embeds a malicious script. When a victim clicks on this link, the script will be executed in the victim's browser giving the attacker the ability to access and/or modify information with no effect on availability of the application. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: R
effect on availability of the application. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://url.sap/sapsecuritypatchday - https://me.sap.com/notes/3467377
CVE ID: CVE-2024-37174 State: PUBLISHED Published: 2024-07-09T04:01:21.084Z Last Updated: 2024-08-02T03:50:55.134Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: SAP_SE Products: SAP CRM WebClient UI Problem Types: CWE-79 Description: Custom CSS support option in SAP CRM WebClient UI does not sufficiently encode user-controlled inputs resulting in Cross-Site Scripting vulnerability. On successful exploitation an attacker can cause limited impact on confidentiality and integrity of the application. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://url.sap/sapsecuritypatchday - https://me.sap.com/notes/3467377
CVE ID: CVE-2024-37175 State: PUBLISHED Published: 2024-07-09T04:07:21.612Z Last Updated: 2024-08-02T03:50:55.138Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: SAP_SE Products: SAP CRM WebClient UI Problem Types: CWE-862 Description: SAP CRM WebClient does not perform necessary authorization check for an authenticated user, resulting in escalation of privileges. This could allow an attacker to access some sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://url.sap/sapsecuritypatchday - https://me.sap.com/notes/3467377
CVE ID: CVE-2024-37176 State: PUBLISHED Published: 2024-06-11T02:14:45.656Z Last Updated: 2024-08-02T03:50:54.783Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:L) Vendors: SAP_SE Products: SAP BW/4HANA Transformation and Data Transfer Process Problem Types: CWE-862 Description: SAP BW/4HANA Transformation and Data Transfer Process (DTP) allows an authenticated attacker to gain higher access levels than they should have by exploiting improper authorization checks. This results in escalation of privileges. It has no impact on the confidentiality of data but may have low impacts on the integrity and availability of the application. Additional Analyst Notes: - CISA ADP V
ta but may have low impacts on the integrity and availability of the application. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://me.sap.com/notes/3465455 - https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html
CVE ID: CVE-2024-37177 State: PUBLISHED Published: 2024-06-11T01:58:36.889Z Last Updated: 2024-08-02T03:50:55.219Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: SAP_SE Products: SAP Financial Consolidation Problem Types: CWE-79 Description: SAP Financial Consolidation allows data to enter a Web application through an untrusted source. These endpoints are exposed over the network and it allows the user to modify the content from the web site. On successful exploitation, an attacker can cause significant impact to confidentiality and integrity of the application. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://
y of the application. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://me.sap.com/notes/3457592 - https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html
CVE ID: CVE-2024-37178 State: PUBLISHED Published: 2024-06-11T02:00:27.054Z Last Updated: 2024-08-02T03:50:55.238Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) Vendors: SAP_SE Products: SAP Financial Consolidation Problem Types: CWE-79 Description: SAP Financial Consolidation does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. These endpoints are exposed over the network. The vulnerability can exploit resources beyond the vulnerable component. On successful exploitation, an attacker can cause limited impact to confidentiality of the application. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program C
limited impact to confidentiality of the application. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://me.sap.com/notes/3457592 - https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html
CVE ID: CVE-2024-37179 State: PUBLISHED Published: 2024-10-08T03:21:02.936Z Last Updated: 2024-10-08T14:10:11.275Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: SAP_SE Products: SAP BusinessObjects Business Intelligence Platform (Web Intelligence) Problem Types: CWE-434 Description: SAP BusinessObjects Business Intelligence Platform allows an authenticated user to send a specially crafted request to the Web Intelligence Reporting Server to download any file from the machine hosting the service, causing high impact on confidentiality of the application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3478615 - https:/
application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3478615 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2024-37180 State: PUBLISHED Published: 2024-07-09T04:41:32.313Z Last Updated: 2024-08-02T03:50:55.233Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N) Vendors: SAP_SE Products: SAP NetWeaver Application Server for ABAP and ABAP Platform Problem Types: CWE-200 Description: Under certain conditions SAP NetWeaver Application Server for ABAP and ABAP Platform allows an attacker to access remote-enabled function module with no further authorization which would otherwise be restricted, the function can be used to read non-sensitive information with low impact on confidentiality of the application. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program
with low impact on confidentiality of the application. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://url.sap/sapsecuritypatchday - https://me.sap.com/notes/3454858
CVE ID: CVE-2024-37181 State: PUBLISHED Published: 2025-01-16T17:59:57.208Z Last Updated: 2025-01-16T19:00:43.410Z Severity: LOW (CVSS 2.6 CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: n/a Products: Intel(R) Neural Compressor software Problem Types: information disclosure, CWE-367 Description: Time-of-check time-of-use race condition in some Intel(R) Neural Compressor software before version v3.0 may allow an authenticated user to potentially enable information disclosure via adjacent access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01219.html
CVE ID: CVE-2024-37182 State: PUBLISHED Published: 2024-06-14T08:39:19.578Z Last Updated: 2024-08-02T03:50:55.403Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Mattermost Products: Mattermost Problem Types: CWE-693 Description: Mattermost Desktop App versions <=5.7.0 fail to correctly prompt for permission when opening external URLs which allows a remote attacker to force a victim over the Internet to run arbitrary programs on the victim's system via custom URI schemes. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://mattermost.com/security-updates
CVE ID: CVE-2024-37183 State: PUBLISHED Published: 2024-06-20T22:09:21.235Z Last Updated: 2024-08-02T03:50:55.374Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: Westermo Products: L210-F2G Lynx Problem Types: CWE-319 Description: Plain text credentials and session ID can be captured with a network sniffer. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-172-03
CVE ID: CVE-2024-37184 State: PUBLISHED Published: 2025-01-14T14:21:30.547Z Last Updated: 2025-01-15T21:05:27.849Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Wavlink Products: Wavlink AC3000 Problem Types: CWE-120 Description: A buffer overflow vulnerability exists in the adm.cgi rep_as_bridge() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to stack-based buffer overflow. An attacker can make an authenticated HTTP request to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2024-2
ogram Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2024-2025
CVE ID: CVE-2024-37185 State: PUBLISHED Published: 2024-07-02T08:14:03.131Z Last Updated: 2024-08-02T03:50:55.193Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L) Vendors: OpenHarmony Products: OpenHarmony Problem Types: CWE-787 Description: in OpenHarmony v4.0.0 and prior versions allow a remote attacker arbitrary code execution in pre-installed apps through out-of-bounds write. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2024/2024-07.md
CVE ID: CVE-2024-37186 State: PUBLISHED Published: 2025-01-14T14:21:26.459Z Last Updated: 2025-01-14T16:03:52.687Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Wavlink Products: Wavlink AC3000 Problem Types: CWE-77 Description: An os command injection vulnerability exists in the adm.cgi set_ledonoff() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2024-
ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2024-2032
CVE ID: CVE-2024-37187 State: PUBLISHED Published: 2024-09-27T17:25:52.630Z Last Updated: 2024-09-27T18:08:09.707Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: Advantech Products: ADAM 5550 Problem Types: CWE-261 Description: Advantech ADAM-5550 share user credentials with a low level of encryption, consisting of base 64 encoding. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-270-01
CVE ID: CVE-2024-37198 State: PUBLISHED Published: 2024-06-21T13:46:27.866Z Last Updated: 2024-08-02T03:50:55.279Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: blazethemes Products: Digital Newspaper Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in blazethemes Digital Newspaper.This issue affects Digital Newspaper: from n/a through 1.1.5. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/digital-newspaper/wordpress-digital-newspaper-theme-1-1-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve