Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-24471 State: PUBLISHED Published: 2025-06-10T16:36:18.093Z Last Updated: 2025-06-10T18:57:48.732Z Severity: MEDIUM (CVSS 6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:F/RL:O/RC:C) Vendors: Fortinet Products: FortiOS Problem Types: CWE-295 Description: An Improper Certificate Validation vulnerability [CWE-295] in FortiOS version 7.6.1 and below, version 7.4.7 and below may allow an EAP verified remote user to connect from FortiClient via revoked certificate. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-24-544
CVE ID: CVE-2025-24472 State: PUBLISHED Published: 2025-02-11T16:50:42.207Z Last Updated: 2025-10-21T22:55:29.648Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H/RL:X/RC:C) Vendors: Fortinet Products: FortiProxy, FortiOS Problem Types: CWE-288 Description: An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS 7.0.0 through 7.0.16 and FortiProxy 7.2.0 through 7.2.12, 7.0.0 through 7.0.19 may allow a remote unauthenticated attacker with prior knowledge of upstream and downstream devices serial numbers to gain super-admin privileges on the downstream device, if the Security Fabric is enabled, via crafted CSF proxy reques
to gain super-admin privileges on the downstream device, if the Security Fabric is enabled, via crafted CSF proxy requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-24-535
CVE ID: CVE-2025-24473 State: PUBLISHED Published: 2025-05-28T07:55:57.065Z Last Updated: 2025-05-28T13:31:09.136Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C) Vendors: Fortinet Products: FortiClientWindows Problem Types: CWE-497 Description: A exposure of sensitive system information to an unauthorized control sphere in Fortinet FortiClientWindows versions 7.2.0 through 7.2.1 may allow an unauthorized remote attacker to view application information via navigation to a hosted webpage, if Windows is configured to accept incoming connections to port 8053 (non-default setup) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortig
ections to port 8053 (non-default setup) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-24-548
CVE ID: CVE-2025-24474 State: PUBLISHED Published: 2025-07-08T14:41:34.528Z Last Updated: 2025-07-08T20:41:36.681Z Severity: LOW (CVSS 2.6 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C) Vendors: Fortinet Products: FortiManager, FortiAnalyzer Problem Types: CWE-89 Description: An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] in FortiManager 7.6.0 through 7.6.1, 7.4.0 through 7.4.6, 7.2 all versions, 7.0 all versions, 6.4 all versions; FortiManager Cloud 7.4.1 through 7.4.6, 7.2 all versions, 7.0 all versions, 6.4 all versions; FortiAnalyzer 7.6.0 through 7.6.1, 7.4.0 through 7.4.6, 7.2 all versions, 7.0 all versions, 6
ersions, 6.4 all versions; FortiAnalyzer 7.6.0 through 7.6.1, 7.4.0 through 7.4.6, 7.2 all versions, 7.0 all versions, 6.4 all versions; and FortiAnalyzer Cloud 7.4.1 through 7.4.6, 7.2 all versions, 7.0 all versions, 6.4 all versions may allow an authenticated attacker with high privilege to extract database information via crafted requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-24-437
CVE ID: CVE-2025-24477 State: PUBLISHED Published: 2025-07-15T08:14:41.283Z Last Updated: 2025-11-03T08:09:31.844Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:U/RC:C) Vendors: Fortinet Products: FortiOS Problem Types: CWE-122 Description: A heap-based buffer overflow in Fortinet FortiOS 7.6.0 through 7.6.2, FortiOS 7.4.0 through 7.4.7, FortiOS 7.2.4 through 7.2.12 allows an attacker to escalate its privileges via a specially crafted CLI command Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-25-026
CVE ID: CVE-2025-24478 State: PUBLISHED Published: 2025-01-28T18:41:30.887Z Last Updated: 2025-02-06T21:25:38.074Z Vendors: Rockwell Automation Products: GuardLogix 5580 SIL 3, Compact GuardLogix 5380 SIL 3 Problem Types: CWE-755 Description: A denial-of-service vulnerability exists in the affected products. The vulnerability could allow a remote, non-privileged user to send malicious requests resulting in a major nonrecoverable fault causing a denial-of-service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1718.html
CVE ID: CVE-2025-24479 State: PUBLISHED Published: 2025-01-28T18:52:18.429Z Last Updated: 2025-02-12T20:01:10.925Z Vendors: Rockwell Automation Products: FactoryTalk View Machine Edition Problem Types: CWE-863 Description: A Local Code Execution Vulnerability exists in the product and version listed above. The vulnerability is due to a default setting in Windows and allows access to the Command Prompt as a higher privileged user. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1719.html
CVE ID: CVE-2025-24480 State: PUBLISHED Published: 2025-01-28T19:01:41.484Z Last Updated: 2025-02-05T18:49:55.832Z Vendors: Rockwell Automation Products: FactoryTalk® View Machine Edition Problem Types: CWE-78 Description: A Remote Code Execution Vulnerability exists in the product and version listed above. The vulnerability is due to lack of input sanitation and could allow a remote attacker to run commands or code as a high privileged user. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1719.html
CVE ID: CVE-2025-24481 State: PUBLISHED Published: 2025-01-28T20:55:54.833Z Last Updated: 2025-02-12T20:01:10.657Z Vendors: Rockwell Automation Products: FactoryTalk® View Site Edition Problem Types: CWE-732 Description: An Incorrect Permission Assignment Vulnerability exists in the product and version listed above. The vulnerability is due to incorrect permissions being assigned to the remote debugger port and can allow for unauthenticated access to the system configuration. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1720.html
CVE ID: CVE-2025-24482 State: PUBLISHED Published: 2025-01-28T20:59:50.868Z Last Updated: 2025-01-28T21:34:16.702Z Vendors: Rockwell Automation Products: FactoryTalk® View Site Edition Problem Types: CWE-94 Description: A Local Code Injection Vulnerability exists in the product and version listed above. The vulnerability is due to incorrect default permissions and allows for DLLs to be executed with higher level permissions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1720.html
CVE ID: CVE-2025-24483 State: PUBLISHED Published: 2025-02-06T07:05:56.408Z Last Updated: 2025-02-12T19:51:10.698Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H) Vendors: Humming Heads Inc. Products: Defense Platform Home Edition Problem Types: CWE-476 Description: NULL pointer dereference vulnerability exists in Defense Platform Home Edition Ver.3.9.51.x and earlier. If an attacker provides specially crafted data to the specific process of the Windows system where the product is running, the system may cause a Blue Screen of Death (BSOD), and as a result, cause a denial-of-service (DoS) condition. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - htt
result, cause a denial-of-service (DoS) condition. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.hummingheads.co.jp/dep/storelist/ - https://jvn.jp/en/jp/JVN66673020/
CVE ID: CVE-2025-24484 State: PUBLISHED Published: 2025-08-12T16:58:58.897Z Last Updated: 2025-08-14T03:55:49.741Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) 800 Series Ethernet Problem Types: Escalation of Privilege, CWE-20 Description: Improper input validation in the Linux kernel-mode driver for some Intel(R) 800 Series Ethernet before version 1.17.2 may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01296.html
CVE ID: CVE-2025-24485 State: PUBLISHED Published: 2025-07-28T13:36:15.487Z Last Updated: 2025-11-03T19:44:47.144Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: MedDream Products: MedDream PACS Premium Problem Types: CWE-918 Description: A server-side request forgery vulnerability exists in the cecho.php functionality of MedDream PACS Premium 7.3.5.860. A specially crafted HTTP request can lead to SSRF. An attacker can make an unauthenticated HTTP request to trigger this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2025-2177
CVE ID: CVE-2025-24486 State: PUBLISHED Published: 2025-08-12T16:59:00.485Z Last Updated: 2025-08-14T03:55:55.986Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) 700 Series Ethernet Problem Types: Escalation of Privilege, CWE-20 Description: Improper input validation in the Linux kernel-mode driver for some Intel(R) 700 Series Ethernet before version 2.28.5 may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01335.html
CVE ID: CVE-2025-24487 State: PUBLISHED Published: 2025-04-15T20:31:50.896Z Last Updated: 2025-04-16T14:45:18.553Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Growatt Products: Cloud portal Problem Types: CWE-639 Description: An unauthenticated attacker can infer the existence of usernames in the system by querying an API. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-105-04
CVE ID: CVE-2025-24489 State: PUBLISHED Published: 2025-08-21T19:44:18.551Z Last Updated: 2025-08-21T20:09:44.406Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: INFINITT Healthcare Products: INFINITT PACS System Manager Problem Types: CWE-434 Description: An attacker could exploit this vulnerability by uploading arbitrary files via a specific service, which could lead to system compromise. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-100-01
CVE ID: CVE-2025-24490 State: PUBLISHED Published: 2025-02-24T07:26:30.679Z Last Updated: 2025-02-24T11:21:41.385Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) Vendors: Mattermost Products: Mattermost Problem Types: CWE-89 Description: Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to use prepared statements in the SQL query of boards reordering which allows an attacker to retrieve data from the database, via a SQL injection when reordering specially crafted boards categories. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2025-24491 State: PUBLISHED Published: 2025-11-11T16:49:47.311Z Last Updated: 2025-11-14T04:55:39.175Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) Killer(TM) Performance Suite software Problem Types: Escalation of Privilege, CWE-427 Description: Uncontrolled search path for some Intel(R) Killer(TM) Performance Suite software before version killer 4.0 40.25.509.1465 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a high complexity attack may enable escalation of privilege. This result may potentially occur via local access whe
with a high complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires active user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01377.html
CVE ID: CVE-2025-24493 State: PUBLISHED Published: 2025-06-08T11:46:53.804Z Last Updated: 2025-06-09T03:31:29.376Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: OpenHarmony Products: OpenHarmony Problem Types: CWE-362 Description: in OpenHarmony v5.0.3 and prior versions allow a local attacker cause information leak through race condition. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2025/2025-06.md
CVE ID: CVE-2025-24494 State: PUBLISHED Published: 2025-03-05T15:15:19.986Z Last Updated: 2025-03-05T16:09:05.368Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Keysight Products: Ixia Vision Product Family Problem Types: CWE-22 Description: Path traversal may allow remote code execution using privileged account (requires device admin account, cannot be performed by a regular user). In combination with the 'Upload' functionality this could be used to execute an arbitrary script or possibly an uploaded binary. Remediation in Version 6.7.0, release date: 20-Oct-24. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-event
elease date: 20-Oct-24. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-063-02 - https://www.keysight.com/us/en/contact.html - https://support.ixiacom.com/ - https://support.ixiacom.com/support-overview/product-support/downloads-updates
CVE ID: CVE-2025-24495 State: PUBLISHED Published: 2025-05-13T21:02:51.390Z Last Updated: 2025-11-03T19:44:48.548Z Severity: MEDIUM (CVSS 5.6 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: n/a Products: Intel(R) Core™ Ultra Processors Problem Types: Information Disclosure, CWE-1419 Description: Incorrect initialization of resource in the branch prediction unit for some Intel(R) Core™ Ultra Processors may allow an authenticated user to potentially enable information disclosure via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01322.html
CVE ID: CVE-2025-24496 State: PUBLISHED Published: 2025-08-20T13:09:08.012Z Last Updated: 2025-11-03T18:08:57.911Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Tenda Products: AC6 V5.0 Problem Types: CWE-288 Description: An information disclosure vulnerability exists in the /goform/getproductInfo functionality of Tenda AC6 V5.0 V02.03.01.110. Specially crafted network packets can lead to a disclosure of sensitive information. An attacker can send packets to trigger this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2025-2164
CVE ID: CVE-2025-24497 State: PUBLISHED Published: 2025-02-05T17:31:05.102Z Last Updated: 2025-02-12T19:41:06.596Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: F5 Products: BIG-IP Problem Types: CWE-125 Description: When URL categorization is configured on a virtual server, undisclosed requests can cause TMM to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://my.f5.com/manage/s/article/K000140920
CVE ID: CVE-2025-24499 State: PUBLISHED Published: 2025-02-11T10:29:05.987Z Last Updated: 2025-02-12T20:51:44.182Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: SCALANCE WAB762-1, SCALANCE WAM763-1, SCALANCE WAM763-1 (ME), SCALANCE WAM763-1 (US), SCALANCE WAM766-1, SCALANCE WAM766-1 (ME), SCALANCE WAM766-1 (US), SCALANCE WAM766-1 EEC, SCALANCE WAM766-1 EEC (ME), SCALANCE WAM766-1 EEC (US), SCALANCE WUB762-1, SCALANCE WUB762-1 iFeatures, SCALANCE WUM763-1, SCALANCE WUM763-1 (US), SCALANCE WUM766-1, SCALANCE WUM766-1 (ME), SCALANCE WUM766-1 (USA) Problem Types: CWE-20 Description: A vulnerability has been identified in SCALANCE
M766-1 (ME), SCALANCE WUM766-1 (USA) Problem Types: CWE-20 Description: A vulnerability has been identified in SCALANCE WAB762-1 (6GK5762-1AJ00-6AA0) (All versions < V3.0.0), SCALANCE WAM763-1 (6GK5763-1AL00-7DA0) (All versions < V3.0.0), SCALANCE WAM763-1 (ME) (6GK5763-1AL00-7DC0) (All versions < V3.0.0), SCALANCE WAM763-1 (US) (6GK5763-1AL00-7DB0) (All versions < V3.0.0), SCALANCE WAM766-1 (6GK5766-1GE00-7DA0) (All versions < V3.0.0), SCALANCE WAM766-1 (ME) (6GK5766-1GE00-7DC0) (All versions < V3.0.0), SCALANCE WAM766-1 (US) (6GK5766-1GE00-7DB0) (All versions < V3.0.0), SCALANCE WAM766-1 EEC (6GK5766-1GE00-7TA0) (All versions < V3.0.0), SCALANCE WAM766-1 EEC (ME) (6GK5766-1GE00-7TC0) (All
CALANCE WAM766-1 EEC (6GK5766-1GE00-7TA0) (All versions < V3.0.0), SCALANCE WAM766-1 EEC (ME) (6GK5766-1GE00-7TC0) (All versions < V3.0.0), SCALANCE WAM766-1 EEC (US) (6GK5766-1GE00-7TB0) (All versions < V3.0.0), SCALANCE WUB762-1 (6GK5762-1AJ00-1AA0) (All versions < V3.0.0), SCALANCE WUB762-1 iFeatures (6GK5762-1AJ00-2AA0) (All versions < V3.0.0), SCALANCE WUM763-1 (6GK5763-1AL00-3AA0) (All versions < V3.0.0), SCALANCE WUM763-1 (6GK5763-1AL00-3DA0) (All versions < V3.0.0), SCALANCE WUM763-1 (US) (6GK5763-1AL00-3AB0) (All versions < V3.0.0), SCALANCE WUM763-1 (US) (6GK5763-1AL00-3DB0) (All versions < V3.0.0), SCALANCE WUM766-1 (6GK5766-1GE00-3DA0) (All versions < V3.0.0), SCALANCE WUM766-1 (
1AL00-3DB0) (All versions < V3.0.0), SCALANCE WUM766-1 (6GK5766-1GE00-3DA0) (All versions < V3.0.0), SCALANCE WUM766-1 (ME) (6GK5766-1GE00-3DC0) (All versions < V3.0.0), SCALANCE WUM766-1 (USA) (6GK5766-1GE00-3DB0) (All versions < V3.0.0). Affected devices do not properly validate input while loading the configuration files. This could allow an authenticated remote attacker to execute arbitrary shell commands on the device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-769027.html
CVE ID: CVE-2025-24500 State: PUBLISHED Published: 2025-01-30T18:15:12.337Z Last Updated: 2025-03-13T13:11:59.284Z Vendors: Broadcom Products: Symantec Privileged Access Management Description: The vulnerability allows an unauthenticated attacker to access information in PAM database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25362
CVE ID: CVE-2025-24501 State: PUBLISHED Published: 2025-01-30T18:21:37.817Z Last Updated: 2025-02-12T20:41:36.667Z Vendors: Broadcom Products: Symantec Privileged Access Management Problem Types: CWE-20 Description: An improper input validation allows an unauthenticated attacker to alter PAM logs by sending a specially crafted HTTP request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25362
CVE ID: CVE-2025-24502 State: PUBLISHED Published: 2025-01-30T18:24:32.902Z Last Updated: 2025-02-05T04:50:21.091Z Vendors: Broadcom Products: Symantec Privileged Access Management Description: An improper session validation allows an unauthenticated attacker to cause certain request notifications to be executed in the context of an incorrect user by spoofing the client IP address. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25362
CVE ID: CVE-2025-24503 State: PUBLISHED Published: 2025-01-30T18:27:08.641Z Last Updated: 2025-02-05T04:51:10.380Z Vendors: Broadcom Products: Symantec Privileged Access Management Description: A malicious actor can fix the session of a PAM user by tricking the user to click on a specially crafted link to the PAM server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25362
CVE ID: CVE-2025-24504 State: PUBLISHED Published: 2025-01-30T18:31:41.795Z Last Updated: 2025-02-05T04:52:30.495Z Vendors: Broadcom Products: Symantec Privileged Access Management Problem Types: CWE-20 Description: An improper input validation the CSRF filter results in unsanitized user input written to the application logs. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25362
CVE ID: CVE-2025-24505 State: PUBLISHED Published: 2025-01-30T18:36:09.450Z Last Updated: 2025-02-05T05:36:07.471Z Vendors: Broadcom Products: Symantec Privileged Access Management Description: This vulnerability allows a high-privileged authenticated PAM user to achieve remote command execution on the affected PAM system by uploading a specially crafted upgrade file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25362
CVE ID: CVE-2025-24506 State: PUBLISHED Published: 2025-01-30T18:39:19.670Z Last Updated: 2025-02-05T05:36:34.940Z Vendors: Broadcom Products: Symantec Privileged Access Management Description: A specific authentication strategy allows to learn ids of PAM users associated with certain authentication types. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25362
CVE ID: CVE-2025-24507 State: PUBLISHED Published: 2025-01-30T18:41:50.906Z Last Updated: 2025-02-05T05:37:57.252Z Vendors: Broadcom Products: Symantec Privileged Access Management Description: This vulnerability allows appliance compromise at boot time. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25362
CVE ID: CVE-2025-24508 State: PUBLISHED Published: 2025-07-07T04:54:31.638Z Last Updated: 2025-07-07T17:13:00.622Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Broadcom Products: Symantec IT Management Suite Description: Extraction of Account Connectivity Credentials (ACCs) from the IT Management Agent secure storage Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/35904