deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-10178
Published: 2024-12-05
Description: The Gutentor – Gutenberg Blocks – Page Builder for Gutenberg Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Countdown widget in all versions up to, and including, 3.3.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3199233%40gutentor%2Ftrunk&old=3179242%40gutentor%2Ftrunk&sfp_email=&sfph_mail=; https://wordpress.org/plugins/gutentor/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/17ecebfd-b07f-415f-892f-e069ab84031a?source=cve
CVE: CVE-2024-42195
Published: 2024-12-05
Description: HCL DevOps Deploy / HCL Launch is vulnerable to HTML injection. This vulnerability may allow a user to embed arbitrary HTML tags in the Web UI potentially leading to sensitive information disclosure.
CVSS Score: 3.1 (LOW)
CWE: CWE-80, CWE-79
References: https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0117908
CVE: CVE-2024-11429
Published: 2024-12-05
Description: The Free Responsive Testimonials, Social Proof Reviews, and Customer Reviews – Stars Testimonials plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.3.3 via the 'stars-testimonials-with-slider-and-masonry-grid' shortcode. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary PHP files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where PHP files can be uploaded and included.
CVSS Score: 8.8 (HIGH)
CWE: CWE-98
References: https://plugins.trac.wordpress.org/browser/stars-testimonials-with-slider-and-masonry-grid/tags/3.3.2/plugin.class.php#L1368; https://plugins.trac.wordpress.org/browser/stars-testimonials-with-slider-and-masonry-grid/trunk/plugin.class.php#L1368; https://www.wordfence.com/threat-intel/vulnerabilities/id/68250b6c-22c8-494f-b0b0-62b80cc4de0c?source=cve
CVE: CVE-2024-10937
Published: 2024-12-05
Description: The Related Posts, Inline Related Posts, Contextual Related Posts, Related Content By PickPlugins plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.0.58 via the wp_ajax_nopriv_related_post_ajax_get_post_ids AJAX action. This makes it possible for unauthenticated attackers to extract sensitive data including titles of posts in draft status.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-284
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3199720%40related-post%2Ftrunk&old=3126666%40related-post%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/85f7c69d-0b48-47af-9451-3cfd4326ffe5?source=cve
CVE: CVE-2022-41137
Published: 2024-12-05
Description: Apache Hive Metastore (HMS) uses SerializationUtilities#deserializeObjectWithTypeInformation method when filtering and fetching partitions that is unsafe and can lead to Remote Code Execution (RCE) since it allows the deserialization of arbitrary data.

In real deployments, the vulnerability can be exploited only by authenticated users/clients that were able to successfully establish a connection to the Metastore. From an API perspective any code that calls the unsafe method may be vulnerable unless it performs additional prerechecks on the input arguments.
CVSS Score: 8.3 (HIGH)
CWE: CWE-502
References: https://github.com/apache/hive; https://github.com/apache/hive/commit/60027bb9c91a93affcfebd9068f064bc1f2a74c9; https://issues.apache.org/jira/browse/HIVE-26539
CVE: CVE-2024-10056
Published: 2024-12-05
Description: The Contact Form Builder by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's livesite-pay shortcode in all versions up to, and including, 4.10.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/3200766/; https://wordpress.org/plugins/contact-form-with-a-meeting-scheduler-by-vcita/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/5d1b419c-2276-415d-8c54-15da9125c442?source=cve
CVE: CVE-2024-10777
Published: 2024-12-05
Description: The AnyWhere Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.2.11 via the 'INSERT_ELEMENTOR' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private or draft posts created by Elementor that they should not have access to.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-639
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3198665%40anywhere-elementor&new=3198665%40anywhere-elementor&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/c2138634-c149-4fd1-a33d-351bbf633ea3?source=cve
CVE: CVE-2024-10848
Published: 2024-12-05
Description: The NewsMunch theme for WordPress is vulnerable to Stored Cross-Site Scripting via a malicious display name in all versions up to, and including, 1.0.35 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://themes.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=250663%40newsmunch&new=250663%40newsmunch&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/1a2b0ff4-9471-4fd0-ac1a-ed5b7b4af4ff?source=cve
CVE: CVE-2024-11324
Published: 2024-12-05
Description: The Accounting for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.6.6. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/accounting-for-woocommerce/tags/stable/views/export.php#L46; https://plugins.trac.wordpress.org/changeset/3201725/; https://www.wordfence.com/threat-intel/vulnerabilities/id/f34b7518-5cb3-4b4e-8b18-927c08c045f7?source=cve
CVE: CVE-2024-11341
Published: 2024-12-05
Description: The Simple Redirection plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5. This is due to missing or incorrect nonce validation on the settings_page() function. This makes it possible for unauthenticated attackers to update the plugin's settings and redirect all site visitors via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/changeset/3201717/; https://www.wordfence.com/threat-intel/vulnerabilities/id/0fa84344-8672-43e1-a430-094021f7366f?source=cve
CVE: CVE-2024-11420
Published: 2024-12-05
Description: The Blocksy theme for WordPress is vulnerable to Stored Cross-Site Scripting via the Contact Info Block link parameter in all versions up to, and including, 2.0.77 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://themes.trac.wordpress.org/changeset/249744/blocksy/2.0.78/inc/components/contacts-box.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/02ad47d5-f011-4e0a-af29-088852d1e886?source=cve
CVE: CVE-2024-11779
Published: 2024-12-05
Description: The WIP WooCarousel Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wip_woocarousel_products_carousel' shortcode in all versions up to, and including, 1.1.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/wip-woocarousel-lite/trunk/shortcode/products_carousel.php#L52; https://plugins.trac.wordpress.org/changeset/3199039/wip-woocarousel-lite/trunk/shortcode/products_carousel.php; https://wordpress.org/plugins/wip-woocarousel-lite
CVE: CVE-2024-45841
Published: 2024-12-05
Description: Incorrect permission assignment for critical resource issue exists in UD-LT1 firmware Ver.2.1.9 and earlier and UD-LT1/EX firmware Ver.2.1.9 and earlier. If an attacker with the guest account of the affected products accesses a specific file, the information containing credentials may be obtained.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-732
References: https://jvn.jp/en/jp/JVN46615026/; https://www.iodata.jp/support/information/2024/11_ud-lt1/
CVE: CVE-2024-47133
Published: 2024-12-05
Description: UD-LT1 firmware Ver.2.1.9 and earlier and UD-LT1/EX firmware Ver.2.1.9 and earlier allow a remote authenticated attacker with an administrative account to execute arbitrary OS commands.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://jvn.jp/en/jp/JVN46615026/; https://www.iodata.jp/support/information/2024/11_ud-lt1/
CVE: CVE-2024-52564
Published: 2024-12-05
Description: Inclusion of undocumented features or chicken bits issue exists in UD-LT1 firmware Ver.2.1.8 and earlier and UD-LT1/EX firmware Ver.2.1.8 and earlier. A remote attacker may disable the firewall function of the affected products. As a result, an arbitrary OS command may be executed and/or configuration settings of the device may be altered.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1242
References: https://jvn.jp/en/jp/JVN46615026/; https://www.iodata.jp/support/information/2024/11_ud-lt1/
CVE: CVE-2024-52270
Published: 2024-12-05
Description: User Interface (UI) Misrepresentation of Critical Information vulnerability in DropBox Sign(HelloSign) allows Content Spoofing.
Displayed version does not show the layer flattened version, once download, If printed (e.g. via Google Chrome -> Examine the print preview): Will render the vulnerability only, not all layers are flattened.
This issue affects DropBox Sign(HelloSign): through 2024-12-04.
CWE: CWE-451
References: https://app.hellosign.com/; https://drive.proton.me/urls/Z6DHXNRZQC#jkfO38rjOiOj; https://new.space/s/ZuHoujvkjdzfY7Uihah7Yg#SKWLU_g2Cihfj4qsq9XNy6F4saxVAzD876PujiDOYfs
CVE: CVE-2024-11316
Published: 2024-12-05
Description: Fileszie Check vulnerabilities allow a malicious user to bypass size limits or overload to the product. 
Affected products:


ABB ASPECT - Enterprise v3.08.02; 
NEXUS Series v3.08.02; 
MATRIX Series v3.08.02
CVSS Score: 7.5 (HIGH)
CWE: CWE-770, CWE-770
References: https://search.abb.com/library/Download.aspx?DocumentID=9AKK108469A7497&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2024-11317
Published: 2024-12-05
Description: Session Fixation vulnerabilities allow an attacker to fix a users session identifier before login providing an opportunity for session takeover on a product. 
Affected products:


ABB ASPECT - Enterprise v3.08.02; 
NEXUS Series v3.08.02; 
MATRIX Series v3.08.02
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-384, CWE-384
References: https://search.abb.com/library/Download.aspx?DocumentID=9AKK108469A7497&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2024-12094
Published: 2024-12-05
Description: This vulnerability exists in the Tinxy mobile app due to storage of logged-in user information in plaintext on the device database. An attacker with physical access to the rooted device could exploit this vulnerability by accessing its database leading to unauthorized access of user information such as username, email address and mobile number.
Note:
To exploit this vulnerability, the device must be rooted/jailbroken.
CWE: CWE-312
References: https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0355
CVE: CVE-2024-48839
Published: 2024-12-05
Description: Improper Input Validation vulnerability allows Remote Code Execution. 
Affected products:


ABB ASPECT - Enterprise v3.08.02; 
NEXUS Series v3.08.02; 
MATRIX Series v3.08.02
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-94
References: https://search.abb.com/library/Download.aspx?DocumentID=9AKK108469A7497&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2024-48840
Published: 2024-12-05
Description: Unauthorized Access vulnerabilities allow Remote Code Execution. 
Affected products:


ABB ASPECT - Enterprise v3.08.02; 
NEXUS Series v3.08.02; 
MATRIX Series v3.08.02
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-94
References: https://search.abb.com/library/Download.aspx?DocumentID=9AKK108469A7497&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2024-48843
Published: 2024-12-05
Description: Denial of Service vulnerabilities where found providing a potiential for device service disruptions. 
Affected products:


ABB ASPECT - Enterprise v3.08.02; 
NEXUS Series v3.08.02; 
MATRIX Series v3.08.02
CVSS Score: 7.7 (HIGH)
CWE: CWE-770, CWE-89
References: https://search.abb.com/library/Download.aspx?DocumentID=9AKK108469A7497&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2024-48844
Published: 2024-12-05
Description: Denial of Service vulnerabilities where found providing a potiential for device service disruptions. 
Affected products:


ABB ASPECT - Enterprise v3.08.02; 
NEXUS Series v3.08.02; 
MATRIX Series v3.08.02
CVSS Score: 7.7 (HIGH)
CWE: CWE-770
References: https://search.abb.com/library/Download.aspx?DocumentID=9AKK108469A7497&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2024-48845
Published: 2024-12-05
Description: Weak Password  Reset Rules vulnerabilities where found providing a potiential for the storage of weak passwords that could  facilitate unauthorized admin/application access. 
Affected products:


ABB ASPECT - Enterprise v3.07.02; 
NEXUS Series v3.07.02; 
MATRIX Series v3.07.02
CVSS Score: 9.4 (CRITICAL)
CWE: CWE-521
References: https://search.abb.com/library/Download.aspx?DocumentID=9AKK108469A7497&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2024-48846
Published: 2024-12-05
Description: Cross Site Request Forgery vulnerabilities where found providing a potiential for exposing sensitive information or changing system settings. 
Affected products:


ABB ASPECT - Enterprise v3.08.02; 
NEXUS Series v3.08.02; 
MATRIX Series v3.08.02
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://search.abb.com/library/Download.aspx?DocumentID=9AKK108469A7497&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2024-48847
Published: 2024-12-05
Description: MD5 Checksum Bypass vulnerabilities where found exploiting a weakness in the way an application dependency calculates or validates MD5 checksum hashes. 
Affected products:


ABB ASPECT - Enterprise v3.08.01; 
NEXUS Series v3.08.01; 
MATRIX Series v3.08.01
CVSS Score: 8.2 (HIGH)
CWE: CWE-328, CWE-327
References: https://search.abb.com/library/Download.aspx?DocumentID=9AKK108469A7497&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2024-51541
Published: 2024-12-05
Description: Local File Inclusion vulnerabilities allow access to sensitive system information. 
Affected products:


ABB ASPECT - Enterprise v3.08.02; 
NEXUS Series v3.08.02; 
MATRIX Series v3.08.02
CVSS Score: 8.2 (HIGH)
CWE: CWE-98
References: https://search.abb.com/library/Download.aspx?DocumentID=9AKK108469A7497&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2024-51542
Published: 2024-12-05
Description: Configuration Download vulnerabilities allow access to dependency configuration information. 
Affected products:


ABB ASPECT - Enterprise v3.08.02; 
NEXUS Series v3.08.02; 
MATRIX Series v3.08.02
CVSS Score: 8.2 (HIGH)
CWE: CWE-552
References: https://search.abb.com/library/Download.aspx?DocumentID=9AKK108469A7497&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2024-51543
Published: 2024-12-05
Description: Information Disclosure vulnerabilities allow access to application configuration information. 
Affected products:


ABB ASPECT - Enterprise v3.08.02; 
NEXUS Series v3.08.02; 
MATRIX Series v3.08.02
CVSS Score: 8.2 (HIGH)
CWE: CWE-15
References: https://search.abb.com/library/Download.aspx?DocumentID=9AKK108469A7497&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2024-51544
Published: 2024-12-05
Description: Service Control vulnerabilities allow access to service restart requests and vm configuration settings. 
Affected products:


ABB ASPECT - Enterprise v3.08.02; 
NEXUS Series v3.08.02; 
MATRIX Series v3.08.02
CVSS Score: 8.2 (HIGH)
CWE: CWE-15
References: https://search.abb.com/library/Download.aspx?DocumentID=9AKK108469A7497&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2024-51545
Published: 2024-12-05
Description: Username Enumeration vulnerabilities allow access to application level username add, delete, modify and list functions. 
Affected products:


ABB ASPECT - Enterprise v3.08.02; 
NEXUS Series v3.08.02; 
MATRIX Series v3.08.02
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-522
References: https://search.abb.com/library/Download.aspx?DocumentID=9AKK108469A7497&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2024-51546
Published: 2024-12-05
Description: Credentials Disclosure vulnerabilities allow access to on board project back-up bundles. 
Affected products:


ABB ASPECT - Enterprise v3.08.02; 
NEXUS Series v3.08.02; 
MATRIX Series v3.08.02
CVSS Score: 7.5 (HIGH)
CWE: CWE-1287, CWE-522
References: https://search.abb.com/library/Download.aspx?DocumentID=9AKK108469A7497&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2024-51548
Published: 2024-12-05
Description: Dangerous File Upload vulnerabilities allow upload of malicious scripts. 
Affected products:


ABB ASPECT - Enterprise v3.08.02; 
NEXUS Series v3.08.02; 
MATRIX Series v3.08.02
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-434
References: https://search.abb.com/library/Download.aspx?DocumentID=9AKK108469A7497&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2024-51549
Published: 2024-12-05
Description: Absolute File Traversal  vulnerabilities allows access and modification of un-intended resources. 
Affected products:


ABB ASPECT - Enterprise v3.08.02; 
NEXUS Series v3.08.02; 
MATRIX Series v3.08.02
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-36, CWE-22
References: https://search.abb.com/library/Download.aspx?DocumentID=9AKK108469A7497&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2024-51550
Published: 2024-12-05
Description: Data Validation / Data Sanitization  vulnerabilities in Linux allows unvalidated and unsanitized data to be injected in an Aspect device. 
Affected products:


ABB ASPECT - Enterprise v3.08.02; 
NEXUS Series v3.08.02; 
MATRIX Series v3.08.02
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-1287
References: https://search.abb.com/library/Download.aspx?DocumentID=9AKK108469A7497&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2024-51551
Published: 2024-12-05
Description: Default Credentail vulnerabilities in ASPECT on Linux allows access to the product using publicly available default credentials. 
Affected products:


ABB ASPECT - Enterprise v3.07.02; 
NEXUS Series v3.07.02; 
MATRIX Series v3.07.02
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-1287, CWE-798
References: https://search.abb.com/library/Download.aspx?DocumentID=9AKK108469A7497&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2024-51554
Published: 2024-12-05
Description: Default Credentail vulnerabilities in ASPECT on Linux allows access to the product using publicly available default credentials. 
Affected products:


ABB ASPECT - Enterprise v3.08.02; 
NEXUS Series v3.08.02; 
MATRIX Series v3.08.02
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-193
References: https://search.abb.com/library/Download.aspx?DocumentID=9AKK108469A7497&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2024-51555
Published: 2024-12-05
Description: Default Credentail vulnerabilities allows access to an Aspect device using publicly available default credentials since the system does not require the installer to change default credentials. 
Affected products:


ABB ASPECT - Enterprise v3.07.02; 
NEXUS Series v3.07.02; 
MATRIX Series v3.07.02
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-1393
References: https://search.abb.com/library/Download.aspx?DocumentID=9AKK108469A7497&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2024-54126
Published: 2024-12-05
Description: This vulnerability exists in the TP-Link Archer C50 due to improper signature verification mechanism in the firmware upgrade process at its web interface. An attacker with administrative privileges within the router’s Wi-Fi range could exploit this vulnerability by uploading and executing malicious firmware which could lead to complete compromise of the targeted device.
CWE: CWE-347, CWE-494
References: https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0354
CVE: CVE-2024-54127
Published: 2024-12-05
Description: This vulnerability exists in the TP-Link Archer C50 due to presence of terminal access on a serial interface without proper access control. An attacker with physical access could exploit this by accessing the UART shell on the vulnerable device. Successful exploitation of this vulnerability could allow the attacker to obtain Wi-Fi credentials of the targeted system.
CWE: CWE-312
References: https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0354
CVE: CVE-2024-6515
Published: 2024-12-05
Description: Web browser interface may manipulate application username/password in clear text or Base64 encoding providing a higher probability of  unintended credentails exposure. 
Affected products:


ABB ASPECT - Enterprise v3.08.02; 
NEXUS Series v3.08.02; 
MATRIX Series v3.08.02
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-319
References: https://search.abb.com/library/Download.aspx?DocumentID=9AKK108469A7497&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2024-6516
Published: 2024-12-05
Description: Cross Site Scripting vulnerabilities where found providing a potential for malicious scripts to be injected into a client browser. 
Affected products:


ABB ASPECT - Enterprise v3.08.02; 
NEXUS Series v3.08.02; 
MATRIX Series v3.08.02
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-79
References: https://search.abb.com/library/Download.aspx?DocumentID=9AKK108469A7497&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2024-6784
Published: 2024-12-05
Description: Server-Side Request Forgery vulnerabilities were found providing a potential for access to unauthorized resources and unintended information disclosure. 
Affected products:


ABB ASPECT - Enterprise v3.08.02; 
NEXUS Series v3.08.02; 
MATRIX Series v3.08.02
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-918, CWE-918
References: https://search.abb.com/library/Download.aspx?DocumentID=9AKK108469A7497&LanguageCode=en&DocumentPartId=&Action=Launch