Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
rolled. This results in arbitrary file read. The privileges of this file read can result in full compromise of the system by various impacts such as disclosing sensitive files allowing for privileged session forgery. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.proxmox.com/?p=pve-http-server.git;a=blob;f=src/PVE/APIServer/AnyEvent.pm;h=a8d60c18102d2eea9235720852fb60d90f405d0a;hb=HEAD#l988 - https://forum.proxmox.com/threads/proxmox-virtual-environment-security-advisories.149331/post-705345
CVE ID: CVE-2024-21546 State: PUBLISHED Published: 2024-12-18T06:06:02.529Z Last Updated: 2025-08-28T14:36:40.840Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P) Vendors: n/a Products: unisharp/laravel-filemanager Problem Types: CWE-94 Description: Versions of the package unisharp/laravel-filemanager before 2.9.1 are vulnerable to Remote Code Execution (RCE) through using a valid mimetype and inserting the . character after the php file extension. This allows the attacker to execute malicious code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-PHP-UNISHARPLARAVELFILEMANAGER-7210316 - https://gist.github.com
hment: References: - https://security.snyk.io/vuln/SNYK-PHP-UNISHARPLARAVELFILEMANAGER-7210316 - https://gist.github.com/ImHades101/338a06816ef97262ba632af9c78b78ca - https://github.com/UniSharp/laravel-filemanager/commit/8170760c0ae316d77b9363cd4c76ab68d3f63f0b
CVE ID: CVE-2024-21547 State: PUBLISHED Published: 2024-12-18T06:06:04.591Z Last Updated: 2024-12-18T14:44:23.335Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P) Vendors: n/a Products: spatie/browsershot Problem Types: CWE-22 Description: Versions of the package spatie/browsershot before 5.0.2 are vulnerable to Directory Traversal due to URI normalisation in the browser where the file:// check can be bypassed with file:\\. An attacker could read any file on the server by exploiting the normalization of \ into /. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-PHP-SPATIEBROWSERSHOT-8501858 - https://gist.github.co
DP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-PHP-SPATIEBROWSERSHOT-8501858 - https://gist.github.com/chuajianshen/baa71db588cfc038fb5d65624a47be81 - https://github.com/spatie/browsershot/commit/dfc3635b83dd980e5c39f8f8c73e87723b99ca01
CVE ID: CVE-2024-21548 State: PUBLISHED Published: 2024-12-18T06:06:03.597Z Last Updated: 2025-07-24T04:34:32.456Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P) Vendors: n/a Products: bun Problem Types: CWE-1321 Description: Versions of the package bun after 0.0.12 and before 1.1.30 are vulnerable to Prototype Pollution due to improper input sanitization. An attacker can exploit this vulnerability through Bun's APIs that accept objects. **Note:** This issue relates to the widely known and actively developed 'Bun' JavaScript runtime. The bun package on NPM at versions 0.0.12 and below belongs to a different and older project that happened to claim the 'bun' name i
age on NPM at versions 0.0.12 and below belongs to a different and older project that happened to claim the 'bun' name in the past. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-JS-BUN-8499549 - https://github.com/oven-sh/bun/commit/a234e067a5dc7837602df3fb5489e826920cc65a - https://github.com/oven-sh/bun/pull/14119
CVE ID: CVE-2024-21549 State: PUBLISHED Published: 2024-12-20T05:00:01.462Z Last Updated: 2025-10-01T10:57:24.761Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N/E:P) Vendors: n/a Products: spatie/browsershot Problem Types: CWE-20 Description: Versions of the package spatie/browsershot before 5.0.3 are vulnerable to Improper Input Validation due to improper URL validation through the setUrl method. An attacker can exploit this vulnerability by utilizing view-source:file://, which allows for arbitrary file reading on a local file. **Note:** This is a bypass of the fix for [CVE-2024-21544](https://security.snyk.io/vuln/SNYK-PHP-SPATIEBROWSERSHOT-8496745). Additional Anal
ypass of the fix for [CVE-2024-21544](https://security.snyk.io/vuln/SNYK-PHP-SPATIEBROWSERSHOT-8496745). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-PHP-SPATIEBROWSERSHOT-8533023 - https://github.com/spatie/browsershot/discussions/906 - https://github.com/spatie/browsershot/commit/f791ce0ae8dd99367dbfa30588ee31e1196e1728
CVE ID: CVE-2024-21550 State: PUBLISHED Published: 2024-08-12T14:54:36.075Z Last Updated: 2024-08-12T15:20:03.103Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: n/a Products: SteVe Problem Types: CWE-79 Description: SteVe is an open platform that implements different version of the OCPP protocol for Electric Vehicle charge points, acting as a central server for management of registered charge points. Attackers can inject arbitrary HTML and Javascript code via WebSockets leading to persistent Cross-Site Scripting in the SteVe management interface. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/steve-community/steve/blob/
terface. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/steve-community/steve/blob/steve-3.6.0/src/main/java/de/rwth/idsg/steve/config/WebSocketConfiguration.java#L69 - https://github.com/steve-community/steve/issues/1526 - https://github.com/steve-community/steve/pull/1527 - https://github.com/steve-community/steve/commit/a79983f843c37705182c8f54eba060c1dce3b6d1
CVE ID: CVE-2024-21552 State: PUBLISHED Published: 2024-07-22T14:18:30.939Z Last Updated: 2024-08-01T22:27:34.853Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: n/a Products: SuperAGI Problem Types: CWE-94 Description: All versions of `SuperAGI` are vulnerable to Arbitrary Code Execution due to unsafe use of the ‘eval’ function. An attacker could induce the LLM output to exploit this vulnerability and gain arbitrary code execution on the SuperAGI application server. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/TransformerOptimus/SuperAGI/blob/9361f0491716e56bd0c0ae2f3b49da201a18c58c/superagi
ner: References: - https://github.com/TransformerOptimus/SuperAGI/blob/9361f0491716e56bd0c0ae2f3b49da201a18c58c/superagi/agent/output_handler.py#L149 - https://github.com/TransformerOptimus/SuperAGI/blob/9361f0491716e56bd0c0ae2f3b49da201a18c58c/superagi/agent/output_handler.py#L180
CVE ID: CVE-2024-21571 State: PUBLISHED Published: 2024-12-06T13:21:11.671Z Last Updated: 2024-12-06T17:54:30.794Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Snyk Products: Code Agent Problem Types: CWE-94 Description: Snyk has identified a remote code execution (RCE) vulnerability in all versions of Code Agent. The vulnerability enables an attacker to execute arbitrary code within the Code Agent container. Exploiting this vulnerability would require an attacker to have network access to the Code Agent within the deployment environment. External exploitation of this vulnerability is unlikely and depends on both misconfigurations of the cluster and/or chai
External exploitation of this vulnerability is unlikely and depends on both misconfigurations of the cluster and/or chaining with another vulnerability. However, internal exploitation (with a cluster misconfiguration) could still be possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cve.org/CVERecord?id=CVE-2024-21571
CVE ID: CVE-2024-21574 State: PUBLISHED Published: 2024-12-12T08:15:11.464Z Last Updated: 2024-12-12T14:37:18.494Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: ltdrdata Products: ComfyUI-Manager Problem Types: CWE-94 Description: The issue stems from a missing validation of the pip field in a POST request sent to the /customnode/install endpoint used to install custom nodes which is added to the server by the extension. This allows an attacker to craft a request that triggers a pip install on a user controlled package or URL, resulting in remote code execution (RCE) on the server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://g
in remote code execution (RCE) on the server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ltdrdata/ComfyUI-Manager/commit/ffc095a3e5acc1c404773a0510e6d055a6a72b0e - https://github.com/ltdrdata/ComfyUI-Manager/blob/ffc095a3e5acc1c404773a0510e6d055a6a72b0e/glob/manager_server.py#L798
CVE ID: CVE-2024-21575 State: PUBLISHED Published: 2024-12-12T14:14:29.321Z Last Updated: 2024-12-12T14:27:59.119Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N) Vendors: ltdrdata Products: ComfyUI-Impact-Pack Problem Types: CWE-35 Description: ComfyUI-Impact-Pack is vulnerable to Path Traversal. The issue stems from missing validation of the `image.filename` field in a POST request sent to the `/upload/temp` endpoint added by the extension to the server. This results in writing arbitrary files to the file system which may, under some conditions, result in remote code execution (RCE). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/
ult in remote code execution (RCE). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ltdrdata/ComfyUI-Impact-Pack/commit/a43dae373e648ae0f0cc0c9768c3cea6a72acff7 - https://github.com/ltdrdata/ComfyUI-Impact-Pack/blob/1087f2ee063c9d53cd198add79b41a7a3465c05a/modules/impact/impact_server.py#L28
CVE ID: CVE-2024-21576 State: PUBLISHED Published: 2024-12-13T11:17:00.945Z Last Updated: 2024-12-23T18:11:35.222Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: bmad4ever Products: ComfyUI-Bmad-Nodes Problem Types: CWE-94 Description: ComfyUI-Bmad-Nodes is vulnerable to Code Injection. The issue stems from a validation bypass in the BuildColorRangeHSVAdvanced, FilterContour and FindContour custom nodes. In the entrypoint function to each node, there’s a call to eval which can be triggered by generating a workflow that injects a crafted string into the node. This can result in executing arbitrary code on the server. Additional Analyst Notes: - CISA ADP Vul
tring into the node. This can result in executing arbitrary code on the server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/bmad4ever/comfyui_bmad_nodes/blob/392af9490cbadf32a1fe92ff820ebabe88c51ee8/cv_nodes.py#L1814
CVE ID: CVE-2024-21577 State: PUBLISHED Published: 2024-12-13T11:17:33.613Z Last Updated: 2024-12-23T18:10:54.543Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: hay86 Products: ComfyUI-Ace-Nodes Problem Types: CWE-94 Description: ComfyUI-Ace-Nodes is vulnerable to Code Injection. The ACE_ExpressionEval node contains an eval() in its entrypoint function that accepts arbitrary user-controlled data. A user can create a workflow that results in executing arbitrary code on the server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/hay86/ComfyUI_AceNodes/blob/5ba01db8a3b7afb8e4aecfaa48823ddeb132bbbb/nodes.py#L1193
CVE ID: CVE-2024-21583 State: PUBLISHED Published: 2024-07-19T05:00:01.569Z Last Updated: 2024-10-31T13:52:00.420Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N/E:P) Vendors: n/a Products: github.com/gitpod-io/gitpod/components/server/go/pkg/lib, github.com/gitpod-io/gitpod/components/ws-proxy/pkg/proxy, github.com/gitpod-io/gitpod/install/installer/pkg/components/auth, github.com/gitpod-io/gitpod/install/installer/pkg/components/public-api-server, github.com/gitpod-io/gitpod/install/installer/pkg/components/server, @gitpod/gitpod-protocol Problem Types: CWE-15 Description: Versions of the package github.com/gitpod-io/gitpod/components/server/go/pkg/lib before main-
Types: CWE-15 Description: Versions of the package github.com/gitpod-io/gitpod/components/server/go/pkg/lib before main-gha.27122; versions of the package github.com/gitpod-io/gitpod/components/ws-proxy/pkg/proxy before main-gha.27122; versions of the package github.com/gitpod-io/gitpod/install/installer/pkg/components/auth before main-gha.27122; versions of the package github.com/gitpod-io/gitpod/install/installer/pkg/components/public-api-server before main-gha.27122; versions of the package github.com/gitpod-io/gitpod/install/installer/pkg/components/server before main-gha.27122; versions of the package @gitpod/gitpod-protocol before 0.1.5-main-gha.27122 are vulnerable to Cookie Tossing d
ha.27122; versions of the package @gitpod/gitpod-protocol before 0.1.5-main-gha.27122 are vulnerable to Cookie Tossing due to a missing __Host- prefix on the _gitpod_io_jwt2_ session cookie. This allows an adversary who controls a subdomain to set the value of the cookie on the Gitpod control plane, which can be assigned to an attacker’s own JWT so that specific actions taken by the victim (such as connecting a new Github organization) are actioned by the attackers session. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGITPODIOGITPODCOMPONENTSSERVERGOPKGLIB-7452074 - https://security.snyk.io/vuln/S
urity.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGITPODIOGITPODCOMPONENTSSERVERGOPKGLIB-7452074 - https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGITPODIOGITPODCOMPONENTSWSPROXYPKGPROXY-7452075 - https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGITPODIOGITPODINSTALLINSTALLERPKGCOMPONENTSAUTH-7452076 - https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGITPODIOGITPODINSTALLINSTALLERPKGCOMPONENTSPUBLICAPISERVER-7452077 - https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGITPODIOGITPODINSTALLINSTALLERPKGCOMPONENTSSERVER-7452078 - https://security.snyk.io/vuln/SNYK-JS-GITPODGITPODPROTOCOL-7452079 - https://app.safebase.io/portal/71ccd717-aa2d-4a1e-942e-c768d37e9e0c/preview?product=%5B%E2%80%A6%5D94
PROTOCOL-7452079 - https://app.safebase.io/portal/71ccd717-aa2d-4a1e-942e-c768d37e9e0c/preview?product=%5B%E2%80%A6%5D942e-c768d37e9e0c&tcuUid=1d505bda-9a38-4ca5-8724-052e6337f34d - https://github.com/gitpod-io/gitpod/pull/19973 - https://github.com/gitpod-io/gitpod/commit/da1053e1013f27a56e6d3533aa251dbd241d0155
CVE ID: CVE-2024-21584 State: PUBLISHED Published: 2024-03-12T07:25:44.452Z Last Updated: 2025-03-13T16:09:31.719Z Vendors: Implem Inc. Products: Pleasanter Problem Types: Cross-site scripting (XSS) Description: Pleasanter 1.3.49.0 and earlier contains a cross-site scripting vulnerability. If an attacker tricks the user to access the product with a specially crafted URL and perform a specific operation, an arbitrary script may be executed on the web browser of the user. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://pleasanter.org/archives/vulnerability-update-202401 - https://jvn.jp/en/jp/JVN51135247/
CVE ID: CVE-2024-21585 State: PUBLISHED Published: 2024-01-12T00:50:59.105Z Last Updated: 2024-11-14T14:40:50.210Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Juniper Networks Products: Junos OS, Junos OS Evolved Problem Types: CWE-755, Denial of Service (DoS) Description: An Improper Handling of Exceptional Conditions vulnerability in BGP session processing of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network-based attacker, using specific timing outside the attacker's control, to flap BGP sessions and cause the routing protocol daemon (rpd) process to crash and restart, leading to a Denial of Service (DoS) condition. Cont
use the routing protocol daemon (rpd) process to crash and restart, leading to a Denial of Service (DoS) condition. Continued BGP session flapping will create a sustained Denial of Service (DoS) condition. This issue only affects routers configured with non-stop routing (NSR) enabled. Graceful Restart (GR) helper mode, enabled by default, is also required for this issue to be exploitable. Note: NSR is not supported on the SRX Series and is therefore not affected by this vulnerability. When the BGP session flaps on the NSR-enabled router, the device enters GR-helper/LLGR-helper mode due to the peer having negotiated GR/LLGR-restarter capability and the backup BGP requests for replication of t
per mode due to the peer having negotiated GR/LLGR-restarter capability and the backup BGP requests for replication of the GR/LLGR-helper session, master BGP schedules, and initiates replication of GR/LLGR stale routes to the backup BGP. In this state, if the BGP session with the BGP peer comes up again, unsolicited replication is initiated for the peer without cleaning up the ongoing GR/LLGR-helper mode replication. This parallel two instances of replication for the same peer leads to the assert if the BGP session flaps again. This issue affects: Juniper Networks Junos OS * All versions earlier than 20.4R3-S9; * 21.2 versions earlier than 21.2R3-S7; * 21.3 versions earlier than 21.3R3-S5; *
* All versions earlier than 20.4R3-S9; * 21.2 versions earlier than 21.2R3-S7; * 21.3 versions earlier than 21.3R3-S5; * 21.4 versions earlier than 21.4R3-S5; * 22.1 versions earlier than 22.1R3-S4; * 22.2 versions earlier than 22.2R3-S3; * 22.3 versions earlier than 22.3R3-S1; * 22.4 versions earlier than 22.4R2-S2, 22.4R3; * 23.2 versions earlier than 23.2R1-S1, 23.2R2. Juniper Networks Junos OS Evolved * All versions earlier than 21.3R3-S5-EVO; * 21.4 versions earlier than 21.4R3-S5-EVO; * 22.1 versions earlier than 22.1R3-S4-EVO; * 22.2 versions earlier than 22.2R3-S3-EVO; * 22.3 versions earlier than 22.3R3-S1-EVO; * 22.4 versions earlier than 22.4R2-S2-EVO, 22.4R3-EVO; * 23.2 versions
VO; * 22.3 versions earlier than 22.3R3-S1-EVO; * 22.4 versions earlier than 22.4R2-S2-EVO, 22.4R3-EVO; * 23.2 versions earlier than 23.2R1-S1-EVO, 23.2R2-EVO. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://supportportal.juniper.net/JSA75723 - https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L - https://supportportal.juniper.net/s/article/MX-GR-and-LLGR-capability-and-compatibility-changes-after-15-1-release
CVE ID: CVE-2024-21586 State: PUBLISHED Published: 2024-07-01T16:34:21.768Z Last Updated: 2024-08-01T22:27:34.830Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Juniper Networks Products: Junos OS Problem Types: CWE-754 Description: An Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on SRX Series and NFX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS). If an affected device receives specific valid traffic destined to the device, it will cause the PFE to crash and restart. Continued receipt and processing of this traffic will creat
d to the device, it will cause the PFE to crash and restart. Continued receipt and processing of this traffic will create a sustained DoS condition. This issue affects Junos OS on SRX Series: * 21.4 versions before 21.4R3-S7.9, * 22.1 versions before 22.1R3-S5.3, * 22.2 versions before 22.2R3-S4.11, * 22.3 versions before 22.3R3, * 22.4 versions before 22.4R3. This issue affects Junos OS on NFX Series: * 21.4 versions before 21.4R3-S8, * 22.1 versions after 22.1R1, * 22.2 versions before 22.2R3-S5, * 22.3 versions before 22.3R3, * 22.4 versions before 22.4R3. Junos OS versions prior to 21.4R1 are not affected by this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Con
ons prior to 21.4R1 are not affected by this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://supportportal.juniper.net/JSA83195
CVE ID: CVE-2024-21587 State: PUBLISHED Published: 2024-01-12T00:51:30.990Z Last Updated: 2025-06-03T14:05:59.834Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Juniper Networks Products: Junos OS Problem Types: CWE-755, Denial of Service (DoS) Description: An Improper Handling of Exceptional Conditions vulnerability in the broadband edge subscriber management daemon (bbe-smgd) of Juniper Networks Junos OS on MX Series allows an attacker directly connected to the vulnerable system who repeatedly flaps DHCP subscriber sessions to cause a slow memory leak, ultimately leading to a Denial of Service (DoS). Memory can only be recovered by manually restarting bb
low memory leak, ultimately leading to a Denial of Service (DoS). Memory can only be recovered by manually restarting bbe-smgd. This issue only occurs if BFD liveness detection for DHCP subscribers is enabled. Systems without BFD liveness detection enabled are not vulnerable to this issue. Indication of the issue can be observed by periodically executing the 'show system processes extensive' command, which will indicate an increase in memory allocation for bbe-smgd. A small amount of memory is leaked every time a DHCP subscriber logs in, which will become visible over time, ultimately leading to memory starvation. user@junos> show system processes extensive | match bbe-smgd 13071 root 24 0 4
ultimately leading to memory starvation. user@junos> show system processes extensive | match bbe-smgd 13071 root 24 0 415M 201M select 0 0:41 7.28% bbe-smgd{bbe-smgd} 13071 root 20 0 415M 201M select 1 0:04 0.00% bbe-smgd{bbe-smgd} ... user@junos> show system processes extensive | match bbe-smgd 13071 root 20 0 420M 208M select 0 4:33 0.10% bbe-smgd{bbe-smgd} 13071 root 20 0 420M 208M select 0 0:12 0.00% bbe-smgd{bbe-smgd} ... This issue affects Juniper Networks Junos OS on MX Series: * All versions earlier than 20.4R3-S9; * 21.2 versions earlier than 21.2R3-S7; * 21.3 versions earlier than 21.3R3-S5; * 21.4 versions earlier than 21.4R3-S5; * 22.1 versions earlier than 22.1R3-S4; * 22.2 ver
sions earlier than 21.3R3-S5; * 21.4 versions earlier than 21.4R3-S5; * 22.1 versions earlier than 22.1R3-S4; * 22.2 versions earlier than 22.2R3-S3; * 22.3 versions earlier than 22.3R3-S2; * 22.4 versions earlier than 22.4R2-S2, 22.4R3; * 23.2 versions earlier than 23.2R1-S1, 23.2R2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://supportportal.juniper.net/JSA75725 - https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L
CVE ID: CVE-2024-21589 State: PUBLISHED Published: 2024-01-12T00:51:46.607Z Last Updated: 2025-06-17T21:09:19.160Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N) Vendors: Juniper Networks Products: Paragon Active Assurance Problem Types: CWE-284 Description: An Improper Access Control vulnerability in the Juniper Networks Paragon Active Assurance Control Center allows an unauthenticated network-based attacker to access reports without authenticating, potentially containing sensitive configuration information. A feature was introduced in version 3.1.0 of the Paragon Active Assurance Control Center which allows users to selectively share account data. By exploiting this
of the Paragon Active Assurance Control Center which allows users to selectively share account data. By exploiting this vulnerability, it is possible to access reports without being logged in, resulting in the opportunity for malicious exfiltration of user data. Note that the Paragon Active Assurance Control Center SaaS offering is not affected by this issue. This issue affects Juniper Networks Paragon Active Assurance versions 3.1.0, 3.2.0, 3.2.2, 3.3.0, 3.3.1, 3.4.0. This issue does not affect Juniper Networks Paragon Active Assurance versions earlier than 3.1.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://supportportal.juniper.net/JSA
nal Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://supportportal.juniper.net/JSA75727 - https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N