auren-research/cyber-sec huggingface dataset:
cveID: CVE-2024-12356
vendorProject: BeyondTrust
product: Privileged Remote Access (PRA) and Remote Support (RS) 
vulnerabilityName: BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) Command Injection Vulnerability 
dateAdded: 2024-12-19
shortDescription: BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) contain a command injection vulnerability, which can allow an unauthenticated attacker to inject commands that are run as a site user. 
requiredAction: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
dueDate: 2024-12-27
knownRansomwareCampaignUse: Unknown
notes: https://www.beyondtrust.com/trust-center/security-advisories/bt24-10 ; https://nvd.nist.gov/vuln/detail/CVE-2024-12356
cwes: CWE-77
cveID: CVE-2021-40407
vendorProject: Reolink
product: RLC-410W IP Camera
vulnerabilityName: Reolink RLC-410W IP Camera OS Command Injection Vulnerability 
dateAdded: 2024-12-18
shortDescription: Reolink RLC-410W IP cameras contain an authenticated OS command injection vulnerability in the device network settings functionality.
requiredAction: The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization if a current mitigation is unavailable.
dueDate: 2025-01-08
knownRansomwareCampaignUse: Unknown
notes: https://reolink.com/product-eol/ ; https://reolink.com/download-center/ ; https://nvd.nist.gov/vuln/detail/CVE-2021-40407
cwes: CWE-78
cveID: CVE-2019-11001
vendorProject: Reolink
product: Multiple IP Cameras
vulnerabilityName: Reolink Multiple IP Cameras OS Command Injection Vulnerability
dateAdded: 2024-12-18
shortDescription: Reolink RLC-410W, C1 Pro, C2 Pro, RLC-422W, and RLC-511W IP cameras contain an authenticated OS command injection vulnerability. This vulnerability allows an authenticated admin to use the "TestEmail" functionality to inject and run OS commands as root.
requiredAction: The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization if a current mitigation is unavailable.
dueDate: 2025-01-08
knownRansomwareCampaignUse: Unknown
notes: https://reolink.com/product-eol/ ; https://reolink.com/download-center/ ; https://nvd.nist.gov/vuln/detail/CVE-2019-11001
cwes: CWE-78
cveID: CVE-2022-23227
vendorProject: NUUO
product: NVRmini2 Devices
vulnerabilityName: NUUO NVRmini2 Devices Missing Authentication Vulnerability 
dateAdded: 2024-12-18
shortDescription: NUUO NVRmini2 devices contain a missing authentication vulnerability that allows an unauthenticated attacker to upload an encrypted TAR archive, which can be abused to add arbitrary users. 
requiredAction: The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.
dueDate: 2025-01-08
knownRansomwareCampaignUse: Unknown
notes: https://nuuo.com/wp-content/uploads/2023/03/NUUO-EOL-letter＿NVRmini-2-and-NVRsolo-series.pdf ; https://nvd.nist.gov/vuln/detail/CVE-2022-23227
cwes: CWE-306
cveID: CVE-2018-14933
vendorProject: NUUO
product: NVRmini Devices
vulnerabilityName: NUUO NVRmini Devices OS Command Injection Vulnerability 
dateAdded: 2024-12-18
shortDescription: NUUO NVRmini devices contain an OS command injection vulnerability. This vulnerability allows remote command execution via shell metacharacters in the uploaddir parameter for a writeuploaddir command.
requiredAction: The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.
dueDate: 2025-01-08
knownRansomwareCampaignUse: Unknown
notes: https://nuuo.com/wp-content/uploads/2023/03/NUUO-EOL-letter%EF%BC%BFNVRmini-2-and-NVRsolo-series.pdf ; https://nvd.nist.gov/vuln/detail/CVE-2018-14933
cwes: CWE-78
cveID: CVE-2024-55956
vendorProject: Cleo
product: Multiple Products
vulnerabilityName: Cleo Multiple Products Unauthenticated File Upload Vulnerability
dateAdded: 2024-12-17
shortDescription: Cleo Harmony, VLTrader, and LexiCom, which are managed file transfer products, contain an unrestricted file upload vulnerability that could allow an unauthenticated user to import and execute arbitrary bash or PowerShell commands on the host system by leveraging the default settings of the Autorun directory.
requiredAction: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
dueDate: 2025-01-07
knownRansomwareCampaignUse: Known
notes: https://support.cleo.com/hc/en-us/articles/28408134019735-Cleo-Product-Security-Update-CVE-2024-55956 ; https://nvd.nist.gov/vuln/detail/CVE-2024-55956
cwes: CWE-276
cveID: CVE-2024-35250
vendorProject: Microsoft
product: Windows
vulnerabilityName: Microsoft Windows Kernel-Mode Driver Untrusted Pointer Dereference Vulnerability 
dateAdded: 2024-12-16
shortDescription: Microsoft Windows Kernel-Mode Driver contains an untrusted pointer dereference vulnerability that allows a local attacker to escalate privileges.
requiredAction: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
dueDate: 2025-01-06
knownRansomwareCampaignUse: Unknown
notes: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-35250 ; https://nvd.nist.gov/vuln/detail/CVE-2024-35250
cwes: CWE-822
cveID: CVE-2024-20767
vendorProject: Adobe
product: ColdFusion
vulnerabilityName: Adobe ColdFusion Improper Access Control Vulnerability
dateAdded: 2024-12-16
shortDescription: Adobe ColdFusion contains an improper access control vulnerability that could allow an attacker to access or modify restricted files via an internet-exposed admin panel.
requiredAction: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
dueDate: 2025-01-06
knownRansomwareCampaignUse: Unknown
notes: https://helpx.adobe.com/security/products/coldfusion/apsb24-14.html ; https://nvd.nist.gov/vuln/detail/CVE-2024-20767
cwes: CWE-284
cveID: CVE-2024-50623
vendorProject: Cleo
product: Multiple Products
vulnerabilityName: Cleo Multiple Products Unrestricted File Upload Vulnerability
dateAdded: 2024-12-13
shortDescription: Cleo Harmony, VLTrader, and LexiCom, which are managed file transfer products, contain an unrestricted file upload and download vulnerability that can lead to remote code execution with elevated privileges.
requiredAction: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
dueDate: 2025-01-03
knownRansomwareCampaignUse: Known
notes: https://support.cleo.com/hc/en-us/articles/28408134019735-Cleo-Product-Security-Update ; https://nvd.nist.gov/vuln/detail/CVE-2024-50623
cwes: CWE-434
cveID: CVE-2024-49138
vendorProject: Microsoft
product: Windows
vulnerabilityName: Microsoft Windows Common Log File System (CLFS) Driver Heap-Based Buffer Overflow Vulnerability
dateAdded: 2024-12-10
shortDescription: Microsoft Windows Common Log File System (CLFS) driver contains a heap-based buffer overflow vulnerability that allows a local attacker to escalate privileges.
requiredAction: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
dueDate: 2024-12-31
knownRansomwareCampaignUse: Unknown
notes: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2024-49138 ; https://nvd.nist.gov/vuln/detail/CVE-2024-49138
cwes: CWE-122
cveID: CVE-2024-51378
vendorProject: CyberPersons
product: CyberPanel
vulnerabilityName: CyberPanel Incorrect Default Permissions Vulnerability
dateAdded: 2024-12-04
shortDescription: CyberPanel contains an incorrect default permissions vulnerability that allows for authentication bypass and the execution of arbitrary commands using shell metacharacters in the statusfile property.
requiredAction: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
dueDate: 2024-12-25
knownRansomwareCampaignUse: Known
notes: https://cyberpanel.net/KnowledgeBase/home/change-logs/ ; https://nvd.nist.gov/vuln/detail/CVE-2024-51378
cwes: CWE-276
cveID: CVE-2024-11667
vendorProject: Zyxel
product: Multiple Firewalls
vulnerabilityName: Zyxel Multiple Firewalls Path Traversal Vulnerability
dateAdded: 2024-12-03
shortDescription: Multiple Zyxel firewalls contain a path traversal vulnerability in the web management interface that could allow an attacker to download or upload files via a crafted URL.
requiredAction: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
dueDate: 2024-12-24
knownRansomwareCampaignUse: Known
notes: https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-protecting-against-recent-firewall-threats-11-21-2024 ; https://nvd.nist.gov/vuln/detail/CVE-2024-11667
cwes: CWE-22
cveID: CVE-2024-11680
vendorProject: ProjectSend
product: ProjectSend
vulnerabilityName: ProjectSend Improper Authentication Vulnerability
dateAdded: 2024-12-03
shortDescription: ProjectSend contains an improper authentication vulnerability that allows a remote, unauthenticated attacker to enable unauthorized modification of the application's configuration via crafted HTTP requests to options.php. Successful exploitation allows attackers to create accounts, upload webshells, and embed malicious JavaScript.
requiredAction: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
dueDate: 2024-12-24
knownRansomwareCampaignUse: Unknown
notes: https://github.com/projectsend/projectsend/commit/193367d937b1a59ed5b68dd4e60bd53317473744 ; https://nvd.nist.gov/vuln/detail/CVE-2024-11680
cwes: CWE-287
cveID: CVE-2023-45727
vendorProject: North Grid
product: Proself
vulnerabilityName: North Grid Proself Improper Restriction of XML External Entity (XXE) Reference Vulnerability
dateAdded: 2024-12-03
shortDescription: North Grid Proself Enterprise/Standard, Gateway, and Mail Sanitize contain an improper restriction of XML External Entity (XXE) reference vulnerability, which could allow a remote, unauthenticated attacker to conduct an XXE attack.
requiredAction: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
dueDate: 2024-12-24
knownRansomwareCampaignUse: Unknown
notes: https://www.proself.jp/information/153/ ; https://nvd.nist.gov/vuln/detail/CVE-2023-45727
cwes: CWE-611
cveID: CVE-2023-28461
vendorProject: Array Networks 
product: AG/vxAG ArrayOS
vulnerabilityName: Array Networks AG and vxAG ArrayOS Missing Authentication for Critical Function Vulnerability
dateAdded: 2024-11-25
shortDescription: Array Networks AG and vxAG ArrayOS contain a missing authentication for critical function vulnerability that allows an attacker to read local files and execute code on the SSL VPN gateway.
requiredAction: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
dueDate: 2024-12-16
knownRansomwareCampaignUse: Known
notes: https://support.arraynetworks.net/prx/001/http/supportportal.arraynetworks.net/documentation/FieldNotice/Array_Networks_Security_Advisory_for_Remote_Code_Execution_Vulnerability_AG.pdf ; https://nvd.nist.gov/vuln/detail/CVE-2023-28461
cwes: CWE-306
cveID: CVE-2024-21287
vendorProject: Oracle
product: Agile Product Lifecycle Management (PLM)
vulnerabilityName: Oracle Agile Product Lifecycle Management (PLM) Incorrect Authorization Vulnerability
dateAdded: 2024-11-21
shortDescription: Oracle Agile Product Lifecycle Management (PLM) contains an incorrect authorization vulnerability in the Process Extension component of the Software Development Kit. Successful exploitation of this vulnerability may result in unauthenticated file disclosure.
requiredAction: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
dueDate: 2024-12-12
knownRansomwareCampaignUse: Unknown
notes: https://www.oracle.com/security-alerts/alert-cve-2024-21287.html ; https://nvd.nist.gov/vuln/detail/CVE-2024-21287
cwes: CWE-863
cveID: CVE-2024-44309
vendorProject: Apple
product: Multiple Products
vulnerabilityName: Apple Multiple Products Cross-Site Scripting (XSS) Vulnerability
dateAdded: 2024-11-21
shortDescription: Apple iOS, macOS, and other Apple products contain an unspecified vulnerability when processing maliciously crafted web content that may lead to a cross-site scripting (XSS) attack.
requiredAction: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
dueDate: 2024-12-12
knownRansomwareCampaignUse: Unknown
notes: https://support.apple.com/en-us/121752, https://support.apple.com/en-us/121753, https://support.apple.com/en-us/121754, https://support.apple.com/en-us/121755, https://support.apple.com/en-us/121756 ; https://nvd.nist.gov/vuln/detail/CVE-2024-44309
cwes: CWE-79
cveID: CVE-2024-44308
vendorProject: Apple
product: Multiple Products
vulnerabilityName: Apple Multiple Products Code Execution Vulnerability
dateAdded: 2024-11-21
shortDescription: Apple iOS, macOS, and other Apple products contain an unspecified vulnerability when processing maliciously crafted web content that may lead to arbitrary code execution.
requiredAction: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
dueDate: 2024-12-12
knownRansomwareCampaignUse: Unknown
notes: https://support.apple.com/en-us/121752, https://support.apple.com/en-us/121753, https://support.apple.com/en-us/121754, https://support.apple.com/en-us/121755, https://support.apple.com/en-us/121756 ; https://nvd.nist.gov/vuln/detail/CVE-2024-44308
cveID: CVE-2024-38813
vendorProject: VMware
product: vCenter Server
vulnerabilityName: VMware vCenter Server Privilege Escalation Vulnerability
dateAdded: 2024-11-20
shortDescription: VMware vCenter contains an improper check for dropped privileges vulnerability. This vulnerability could allow an attacker with network access to the vCenter Server to escalate privileges to root by sending a specially crafted packet.
requiredAction: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
dueDate: 2024-12-11
knownRansomwareCampaignUse: Unknown
notes: https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24968 ; https://nvd.nist.gov/vuln/detail/CVE-2024-38813
cwes: CWE-250
CWE-273
cveID: CVE-2024-38812
vendorProject: VMware
product: vCenter Server
vulnerabilityName: VMware vCenter Server Heap-Based Buffer Overflow Vulnerability
dateAdded: 2024-11-20
shortDescription: VMware vCenter Server contains a heap-based buffer overflow vulnerability in the implementation of the DCERPC protocol. This vulnerability could allow an attacker with network access to the vCenter Server to execute remote code by sending a specially crafted packet.
requiredAction: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
dueDate: 2024-12-11
knownRansomwareCampaignUse: Unknown
notes: https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24968 ; https://nvd.nist.gov/vuln/detail/CVE-2024-38812
cwes: CWE-122
cveID: CVE-2024-9474
vendorProject: Palo Alto Networks
product: PAN-OS
vulnerabilityName: Palo Alto Networks PAN-OS Management Interface OS Command Injection Vulnerability
dateAdded: 2024-11-18
shortDescription: Palo Alto Networks PAN-OS contains an OS command injection vulnerability that allows for privilege escalation through the web-based management interface for several PAN products, including firewalls and VPN concentrators.
requiredAction: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Additionally, the management interfaces for affected devices should not be exposed to untrusted networks, including the internet.
dueDate: 2024-12-09
knownRansomwareCampaignUse: Known
notes: https://security.paloaltonetworks.com/CVE-2024-9474 ; https://nvd.nist.gov/vuln/detail/CVE-2024-9474
cwes: CWE-77
cveID: CVE-2024-0012
vendorProject: Palo Alto Networks
product: PAN-OS
vulnerabilityName: Palo Alto Networks PAN-OS Management Interface Authentication Bypass Vulnerability
dateAdded: 2024-11-18
shortDescription: Palo Alto Networks PAN-OS contains an authentication bypass vulnerability in the web-based management interface for several PAN-OS products, including firewalls and VPN concentrators.
requiredAction: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Additionally, management interface for affected devices should not be exposed to untrusted networks, including the internet.
dueDate: 2024-12-09
knownRansomwareCampaignUse: Known
notes: https://security.paloaltonetworks.com/CVE-2024-0012 ; https://nvd.nist.gov/vuln/detail/CVE-2024-0012
cwes: CWE-306
cveID: CVE-2024-1212
vendorProject: Progress
product: Kemp LoadMaster
vulnerabilityName: Progress Kemp LoadMaster OS Command Injection Vulnerability
dateAdded: 2024-11-18
shortDescription: Progress Kemp LoadMaster contains an OS command injection vulnerability that allows an unauthenticated, remote attacker to access the system through the LoadMaster management interface, enabling arbitrary system command execution.
requiredAction: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
dueDate: 2024-12-09
knownRansomwareCampaignUse: Unknown
notes: https://community.progress.com/s/article/Release-Notice-LMOS-7-2-59-2-7-2-54-8-7-2-48-10-CVE-2024-1212 ; https://nvd.nist.gov/vuln/detail/CVE-2024-1212
cwes: CWE-78
cveID: CVE-2024-9465
vendorProject: Palo Alto Networks
product: Expedition
vulnerabilityName: Palo Alto Networks Expedition SQL Injection Vulnerability
dateAdded: 2024-11-14
shortDescription: Palo Alto Networks Expedition contains a SQL injection vulnerability that allows an unauthenticated attacker to reveal Expedition database contents, such as password hashes, usernames, device configurations, and device API keys. With this, attackers can also create and read arbitrary files on the Expedition system.
requiredAction: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
dueDate: 2024-12-05
knownRansomwareCampaignUse: Unknown
notes: https://security.paloaltonetworks.com/PAN-SA-2024-0010 ; https://nvd.nist.gov/vuln/detail/CVE-2024-9465
cwes: CWE-89
cveID: CVE-2024-9463
vendorProject: Palo Alto Networks
product: Expedition
vulnerabilityName: Palo Alto Networks Expedition OS Command Injection Vulnerability
dateAdded: 2024-11-14
shortDescription: Palo Alto Networks Expedition contains an OS command injection vulnerability that allows an unauthenticated attacker to run arbitrary OS commands as root in Expedition, resulting in disclosure of usernames, cleartext passwords, device configurations, and device API keys of PAN-OS firewalls.
requiredAction: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
dueDate: 2024-12-05
knownRansomwareCampaignUse: Unknown
notes: https://security.paloaltonetworks.com/PAN-SA-2024-0010 ; https://nvd.nist.gov/vuln/detail/CVE-2024-9463
cwes: CWE-78
cveID: CVE-2021-26086
vendorProject: Atlassian
product: Jira Server and Data Center
vulnerabilityName: Atlassian Jira Server and Data Center Path Traversal Vulnerability
dateAdded: 2024-11-12
shortDescription: Atlassian Jira Server and Data Center contain a path traversal vulnerability that allows a remote attacker to read particular files in the /WEB-INF/web.xml endpoint.
requiredAction: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
dueDate: 2024-12-03
knownRansomwareCampaignUse: Unknown
notes: https://jira.atlassian.com/browse/JRASERVER-72695 ; https://nvd.nist.gov/vuln/detail/CVE-2021-26086
cwes: CWE-22
cveID: CVE-2014-2120
vendorProject: Cisco
product: Adaptive Security Appliance (ASA)
vulnerabilityName: Cisco Adaptive Security Appliance (ASA) Cross-Site Scripting (XSS) Vulnerability
dateAdded: 2024-11-12
shortDescription: Cisco Adaptive Security Appliance (ASA) contains a cross-site scripting (XSS) vulnerability in the WebVPN login page. This vulnerability allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter.
requiredAction: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
dueDate: 2024-12-03
knownRansomwareCampaignUse: Unknown
notes: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-CVE-2014-2120 ; https://nvd.nist.gov/vuln/detail/CVE-2014-2120
cwes: CWE-79
cveID: CVE-2021-41277
vendorProject: Metabase
product: Metabase
vulnerabilityName: Metabase GeoJSON API Local File Inclusion Vulnerability
dateAdded: 2024-11-12
shortDescription: Metabase contains a local file inclusion vulnerability in the custom map support in the API to read GeoJSON formatted data.
requiredAction: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
dueDate: 2024-12-03
knownRansomwareCampaignUse: Unknown
notes: https://github.com/metabase/metabase/security/advisories/GHSA-w73v-6p7p-fpfr ; https://nvd.nist.gov/vuln/detail/CVE-2021-41277
cwes: CWE-200
cveID: CVE-2024-43451
vendorProject: Microsoft
product: Windows
vulnerabilityName: Microsoft Windows NTLMv2 Hash Disclosure Spoofing Vulnerability
dateAdded: 2024-11-12
shortDescription: Microsoft Windows contains an NTLMv2 hash spoofing vulnerability that could result in disclosing a user's NTLMv2 hash to an attacker via a file open operation. The attacker could then leverage this hash to impersonate that user.
requiredAction: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
dueDate: 2024-12-03
knownRansomwareCampaignUse: Unknown
notes: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43451 ; https://nvd.nist.gov/vuln/detail/CVE-2024-43451
cwes: CWE-73
cveID: CVE-2024-49039
vendorProject: Microsoft
product: Windows
vulnerabilityName: Microsoft Windows Task Scheduler Privilege Escalation Vulnerability
dateAdded: 2024-11-12
shortDescription: Microsoft Windows Task Scheduler contains a privilege escalation vulnerability that can allow an attacker-provided, local application to escalate privileges outside of its AppContainer, and access privileged RPC functions.
requiredAction: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
dueDate: 2024-12-03
knownRansomwareCampaignUse: Known
notes: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2024-49039 ; https://nvd.nist.gov/vuln/detail/CVE-2024-49039
cwes: CWE-287
cveID: CVE-2019-16278
vendorProject: Nostromo
product: nhttpd
vulnerabilityName: Nostromo nhttpd Directory Traversal Vulnerability
dateAdded: 2024-11-07
shortDescription: Nostromo nhttpd contains a directory traversal vulnerability in the http_verify() function in a non-chrooted nhttpd server allowing for remote code execution.
requiredAction: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
dueDate: 2024-11-28
knownRansomwareCampaignUse: Unknown
notes: https://www.nazgul.ch/dev/nostromo_cl.txt ; https://nvd.nist.gov/vuln/detail/CVE-2019-16278
cwes: CWE-22
cveID: CVE-2024-51567
vendorProject: CyberPersons
product: CyberPanel
vulnerabilityName: CyberPanel Incorrect Default Permissions Vulnerability
dateAdded: 2024-11-07
shortDescription: CyberPanel contains an incorrect default permissions vulnerability that allows a remote, unauthenticated attacker to execute commands as root.
requiredAction: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
dueDate: 2024-11-28
knownRansomwareCampaignUse: Known
notes: https://cyberpanel.net/blog/detials-and-fix-of-recent-security-issue-and-patch-of-cyberpanel ; https://nvd.nist.gov/vuln/detail/CVE-2024-51567
cwes: CWE-276