Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-38808 State: PUBLISHED Published: 2024-08-20T07:12:44.736Z Last Updated: 2024-10-30T18:41:27.943Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: Spring Products: Spring Framework Description: In Spring Framework versions 5.3.0 - 5.3.38 and older unsupported versions, it is possible for a user to provide a specially crafted Spring Expression Language (SpEL) expression that may cause a denial of service (DoS) condition. Specifically, an application is vulnerable when the following is true: * The application evaluates user-supplied SpEL expressions. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https
pplied SpEL expressions. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://spring.io/security/cve-2024-38808
CVE ID: CVE-2024-38809 State: PUBLISHED Published: 2024-09-27T16:39:52.644Z Last Updated: 2024-09-27T19:19:01.160Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: N/A Products: Spring Framework Problem Types: Spring Framework DoS via conditional HTTP request Description: Applications that parse ETags from "If-Match" or "If-None-Match" request headers are vulnerable to DoS attack. Users of affected versions should upgrade to the corresponding fixed version. Users of older, unsupported versions could enforce a size limit on "If-Match" and "If-None-Match" headers, e.g. through a Filter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment:
-None-Match" headers, e.g. through a Filter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://spring.io/security/cve-2024-38809
CVE ID: CVE-2024-38810 State: PUBLISHED Published: 2024-08-20T03:35:24.795Z Last Updated: 2024-08-20T13:34:50.068Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: spring Products: spring security Problem Types: CWE-287 Description: Missing Authorization When Using @AuthorizeReturnObject in Spring Security 6.3.0 and 6.3.1 allows attacker to render security annotations inaffective. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://spring.io/security/cve-2024-38810
CVE ID: CVE-2024-38811 State: PUBLISHED Published: 2024-09-03T09:47:28.120Z Last Updated: 2024-09-05T15:36:52.319Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: n/a Products: Fusion Problem Types: CWE-20 Description: VMware Fusion (13.x before 13.6) contains a code-execution vulnerability due to the usage of an insecure environment variable. A malicious actor with standard user privileges may exploit this vulnerability to execute code in the context of the Fusion application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24939
CVE ID: CVE-2024-38812 State: PUBLISHED Published: 2024-09-17T17:13:09.778Z Last Updated: 2025-10-21T22:55:44.777Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: n/a Products: VMware vCenter Server, VMware Cloud Foundation Problem Types: CWE-122 Description: The vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger this vulnerability by sending a specially crafted network packet potentially leading to remote code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.broadcom.com/web/ecx/support-content-not
dditional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24968
CVE ID: CVE-2024-38813 State: PUBLISHED Published: 2024-09-17T17:13:13.924Z Last Updated: 2025-10-21T22:55:44.624Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: n/a Products: VMware vCenter Server, VMware Cloud Foundation Problem Types: CWE-273, CWE-250 Description: The vCenter Server contains a privilege escalation vulnerability. A malicious actor with network access to vCenter Server may trigger this vulnerability to escalate privileges to root by sending a specially crafted network packet. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories
t: References: - https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24968
CVE ID: CVE-2024-38814 State: PUBLISHED Published: 2024-10-16T16:59:20.174Z Last Updated: 2024-10-16T17:53:24.283Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: N/A Products: VMware HCX Problem Types: CWE-89 Description: An authenticated SQL injection vulnerability in VMware HCX was privately reported to VMware. A malicious authenticated user with non-administrator privileges may be able to enter specially crafted SQL queries and perform unauthorized remote code execution on the HCX manager. Updates are available to remediate this vulnerability in affected VMware products. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.broad
lity in affected VMware products. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25019
CVE ID: CVE-2024-38815 State: PUBLISHED Published: 2024-10-09T19:47:52.578Z Last Updated: 2024-10-09T21:05:46.428Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: n/a Products: VMware NSX, VMware Cloud Foundation Problem Types: CWE-79 Description: VMware NSX contains a content spoofing vulnerability. An unauthenticated malicious actor may be able to craft a URL and redirect a victim to an attacker controlled domain leading to sensitive information disclosure. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25047
CVE ID: CVE-2024-38816 State: PUBLISHED Published: 2024-09-13T06:10:06.598Z Last Updated: 2025-03-18T15:06:29.551Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Spring Products: Spring Description: Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the process in which the Spring application is running. Specifically, an application is vulnerable when both of the following are true: * the web application uses RouterFunctions to serve static resources * resourc
able when both of the following are true: * the web application uses RouterFunctions to serve static resources * resource handling is explicitly configured with a FileSystemResource location However, malicious requests are blocked and rejected when any of the following is true: * the Spring Security HTTP Firewall https://docs.spring.io/spring-security/reference/servlet/exploits/firewall.html is in use * the application runs on Tomcat or Jetty Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://spring.io/security/cve-2024-38816
CVE ID: CVE-2024-38817 State: PUBLISHED Published: 2024-10-09T19:28:05.514Z Last Updated: 2024-10-10T07:54:34.429Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: n/a Products: VMware NSX, VMware Cloud Foundation Problem Types: CWE-77 Description: VMware NSX contains a command injection vulnerability. A malicious actor with access to the NSX Edge CLI terminal may be able to craft malicious payloads to execute arbitrary commands on the operating system as root. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25047
CVE ID: CVE-2024-38818 State: PUBLISHED Published: 2024-10-09T19:35:41.151Z Last Updated: 2024-10-09T21:05:11.329Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L) Vendors: n/a Products: VMware NSX, VMware Cloud Foundation Problem Types: CWE-269 Description: VMware NSX contains a local privilege escalation vulnerability. An authenticated malicious actor may exploit this vulnerability to obtain permissions from a separate group role than previously assigned. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25047
CVE ID: CVE-2024-38819 State: PUBLISHED Published: 2024-12-19T17:15:12.704Z Last Updated: 2025-01-10T13:06:45.393Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: N/A Products: Spring Framework Problem Types: CWE-22 Description: Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the process in which the Spring application is running. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://spring.io/security/cve-2024-388
l Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://spring.io/security/cve-2024-38819
CVE ID: CVE-2024-38820 State: PUBLISHED Published: 2024-10-18T05:39:05.275Z Last Updated: 2024-11-29T12:04:41.387Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: VMware Products: Spring Description: The fix for CVE-2022-22968 made disallowedFields patterns in DataBinder case insensitive. However, String.toLowerCase() has some Locale dependent exceptions that could potentially result in fields not protected as expected. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://spring.io/security/cve-2024-38820
CVE ID: CVE-2024-38821 State: PUBLISHED Published: 2024-10-28T07:06:13.404Z Last Updated: 2025-01-24T20:03:04.932Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: Spring Products: Spring Description: Spring WebFlux applications that have Spring Security authorization rules on static resources can be bypassed under certain circumstances. For this to impact an application, all of the following must be true: * It must be a WebFlux application * It must be using Spring's static resources support * It must have a non-permitAll authorization rule applied to the static resources support Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: R
le applied to the static resources support Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://spring.io/security/cve-2024-38821
CVE ID: CVE-2024-38822 State: PUBLISHED Published: 2025-06-13T06:40:41.885Z Last Updated: 2025-06-16T18:06:37.211Z Severity: LOW (CVSS 2.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N) Vendors: VMware Products: SALT Description: Multiple methods in the salt master skip minion token validation. Therefore a misbehaving minion can impersonate another minion. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.saltproject.io/en/3006/topics/releases/3006.12.html - https://docs.saltproject.io/en/3007/topics/releases/3007.4.html
CVE ID: CVE-2024-38823 State: PUBLISHED Published: 2025-06-13T06:41:26.536Z Last Updated: 2025-06-13T13:59:57.223Z Severity: LOW (CVSS 2.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N) Vendors: VMware Products: SALT Description: Salt's request server is vulnerable to replay attacks when not using a TLS encrypted transport. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.saltproject.io/en/3006/topics/releases/3006.12.html - https://docs.saltproject.io/en/3007/topics/releases/3007.4.html
CVE ID: CVE-2024-38824 State: PUBLISHED Published: 2025-06-13T07:10:31.166Z Last Updated: 2025-06-16T18:07:37.440Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) Vendors: VMware Products: SALT Description: Directory traversal vulnerability in recv_file method allows arbitrary files to be written to the master cache directory. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.saltproject.io/en/3006/topics/releases/3006.12.html - https://docs.saltproject.io/en/3007/topics/releases/3007.4.html
CVE ID: CVE-2024-38825 State: PUBLISHED Published: 2025-06-13T06:46:12.145Z Last Updated: 2025-06-13T14:01:02.386Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: VMware Products: SALT Description: The salt.auth.pki module does not properly authenticate callers. The "password" field contains a public certificate which is validated against a CA certificate by the module. This is not pki authentication, as the caller does not need access to the corresponding private key for the authentication attempt to be accepted. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.saltproject.io/en/3006/topics/releases/3006.12.html - https://docs.s
- CISA ADP Vulnrichment: References: - https://docs.saltproject.io/en/3006/topics/releases/3006.12.html - https://docs.saltproject.io/en/3007/topics/releases/3007.4.html
CVE ID: CVE-2024-38826 State: PUBLISHED Published: 2024-11-11T05:33:44.634Z Last Updated: 2025-03-17T22:00:39.865Z Vendors: Cloud Foundry Products: Cloud Foundry Description: Authenticated users can upload specifically crafted files to leak server resources. This behavior can potentially be used to run a denial of service attack against Cloud Controller. The Cloud Foundry project recommends upgrading the following releases: * Upgrade capi release version to 1.194.0 or greater * Upgrade cf-deployment version to v44.1.0 or greater. This includes a patched capi release Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cloudfoundry.org/blog/cve-2024-38826-cloud-control
nal Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cloudfoundry.org/blog/cve-2024-38826-cloud-controller-denial-of-service-attack/
CVE ID: CVE-2024-38827 State: PUBLISHED Published: 2024-12-02T14:32:12.471Z Last Updated: 2025-01-24T20:03:06.325Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: Spring by VMware Tanzu Products: Spring Security Problem Types: CWE-639 Description: The usage of String.toLowerCase() and String.toUpperCase() has some Locale dependent exceptions that could potentially result in authorization rules not working properly. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://spring.io/security/cve-2024-38827
CVE ID: CVE-2024-38828 State: PUBLISHED Published: 2024-11-18T03:45:46.542Z Last Updated: 2025-05-09T20:03:35.921Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Spring Products: Spring Description: Spring MVC controller methods with an @RequestBody byte[] method parameter are vulnerable to a DoS attack. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://spring.io/security/cve-2024-38828
CVE ID: CVE-2024-38829 State: PUBLISHED Published: 2024-12-04T21:06:05.021Z Last Updated: 2024-12-10T14:33:55.692Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Spring Products: Spring LDAP Problem Types: CWE-178 Description: A vulnerability in Spring LDAP allows data exposure for case sensitive comparisons.This issue affects Spring LDAP: from 2.4.0 through 2.4.3, from 3.0.0 through 3.0.9, from 3.1.0 through 3.1.7, from 3.2.0 through 3.2.7, AND all versions prior to 2.4.0. The usage of String.toLowerCase() and String.toUpperCase() has some Locale dependent exceptions that could potentially result in unintended columns from being queried Related to CVE-2024-38
ocale dependent exceptions that could potentially result in unintended columns from being queried Related to CVE-2024-38820 https://spring.io/security/cve-2024-38820 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://spring.io/security/cve-2024-38829
CVE ID: CVE-2024-38830 State: PUBLISHED Published: 2024-11-26T11:49:16.781Z Last Updated: 2025-02-10T22:19:20.956Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: VMware Products: VMware Aria Operations Description: VMware Aria Operations contains a local privilege escalation vulnerability. A malicious actor with local administrative privileges may trigger this vulnerability to escalate privileges to root user on the appliance running VMware Aria Operations. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25199
CVE ID: CVE-2024-38831 State: PUBLISHED Published: 2024-11-26T11:50:20.202Z Last Updated: 2024-11-26T15:06:18.650Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: VMware Products: VMware Aria Operations Description: VMware Aria Operations contains a local privilege escalation vulnerability. A malicious actor with local administrative privileges can insert malicious commands into the properties file to escalate privileges to a root user on the appliance running VMware Aria Operations. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25199
CVE ID: CVE-2024-38832 State: PUBLISHED Published: 2024-11-26T11:51:39.551Z Last Updated: 2024-12-06T20:03:26.251Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L) Vendors: VMware Products: VMware Aria Operations Description: VMware Aria Operations contains a stored cross-site scripting vulnerability. A malicious actor with editing access to views may be able to inject malicious script leading to stored cross-site scripting in the product VMware Aria Operations. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25199
CVE ID: CVE-2024-38833 State: PUBLISHED Published: 2024-11-26T11:54:54.847Z Last Updated: 2024-12-06T20:04:41.237Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L) Vendors: VMware Products: VMware Aria Operations Description: VMware Aria Operations contains a stored cross-site scripting vulnerability. A malicious actor with editing access to email templates might inject malicious script leading to stored cross-site scripting in the product VMware Aria Operations. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25199
CVE ID: CVE-2024-38834 State: PUBLISHED Published: 2024-11-26T11:56:48.573Z Last Updated: 2024-12-06T20:04:02.459Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N) Vendors: VMware Products: VMware Aria Operations Description: VMware Aria Operations contains a stored cross-site scripting vulnerability. A malicious actor with editing access to cloud provider might be able to inject malicious script leading to stored cross-site scripting in the product VMware Aria Operations. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25199
CVE ID: CVE-2024-38856 State: PUBLISHED Published: 2024-08-05T08:20:18.081Z Last Updated: 2025-10-21T22:55:48.822Z Vendors: Apache Software Foundation Products: Apache OFBiz Problem Types: CWE-863 Description: Incorrect Authorization vulnerability in Apache OFBiz. This issue affects Apache OFBiz: through 18.12.14. Users are recommended to upgrade to version 18.12.15, which fixes the issue. Unauthenticated endpoints could allow execution of screen rendering code of screens if some preconditions are met (such as when the screen definitions don't explicitly check user's permissions because they rely on the configuration of their endpoints). Additional Analyst Notes: - CVE Program Container: - C
sions because they rely on the configuration of their endpoints). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://ofbiz.apache.org/download.html - https://ofbiz.apache.org/security.html - https://lists.apache.org/thread/olxxjk6b13sl3wh9cmp0k2dscvp24l7w - https://issues.apache.org/jira/browse/OFBIZ-13128
CVE ID: CVE-2024-38857 State: PUBLISHED Published: 2024-07-02T08:11:19.241Z Last Updated: 2024-08-02T04:19:20.353Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Checkmk GmbH Products: Checkmk Problem Types: CWE-79 Description: Improper neutralization of input in Checkmk before versions 2.3.0p8, 2.2.0p28, 2.1.0p45, and 2.0.0 (EOL) allows attackers to craft malicious links that can facilitate phishing attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://checkmk.com/werk/17059
CVE ID: CVE-2024-38858 State: PUBLISHED Published: 2024-09-02T09:16:40.902Z Last Updated: 2024-09-03T14:08:05.571Z Vendors: Checkmk GmbH Products: Checkmk Problem Types: CWE-79 Description: Improper neutralization of input in Checkmk before version 2.3.0p14 allows attackers to inject and run malicious scripts in the Robotmk logs view. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://checkmk.com/werk/17232
CVE ID: CVE-2024-38859 State: PUBLISHED Published: 2024-08-26T14:15:32.555Z Last Updated: 2024-08-26T15:22:30.830Z Vendors: Checkmk GmbH Products: Checkmk Problem Types: CWE-80 Description: XSS in the view page with the SLA column configured in Checkmk versions prior to 2.3.0p14, 2.2.0p33, 2.1.0p47 and 2.0.0 (EOL) allowed malicious users to execute arbitrary scripts by injecting HTML elements into the SLA column title. These scripts could be executed when the view page was cloned by other users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://checkmk.com/werk/17026
CVE ID: CVE-2024-38860 State: PUBLISHED Published: 2024-09-17T14:01:09.555Z Last Updated: 2024-09-17T17:16:28.885Z Vendors: Checkmk GmbH Products: Checkmk Problem Types: CWE-79 Description: Improper neutralization of input in Checkmk before versions 2.3.0p16 and 2.2.0p34 allows attackers to craft malicious links that can facilitate phishing attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://checkmk.com/werk/17094
CVE ID: CVE-2024-38861 State: PUBLISHED Published: 2024-09-27T08:11:46.790Z Last Updated: 2024-09-27T15:21:54.470Z Problem Types: CWE-295 Description: Improper Certificate Validation in Checkmk Exchange plugin MikroTik allows attackers in MitM position to intercept traffic. This issue affects MikroTik: from 2.0.0 through 2.5.5, from 0.4a_mk through 2.0a. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://exchange.checkmk.com/p/mikrotik
CVE ID: CVE-2024-38862 State: PUBLISHED Published: 2024-10-14T07:19:01.674Z Last Updated: 2024-10-14T15:34:37.344Z Vendors: Checkmk GmbH Products: Checkmk Problem Types: CWE-532 Description: Insertion of Sensitive Information into Log File in Checkmk GmbH's Checkmk versions <2.3.0p18, <2.2.0p35, <2.1.0p48 and <=2.0.0p39 (EOL) causes SNMP and IMPI secrets of host and folder properties to be written to audit log files accessible to administrators. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://checkmk.com/werk/17095