deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-39801
Published: 2025-01-14
Description: Multiple buffer overflow vulnerabilities exist in the qos.cgi qos_settings() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to stack-based buffer overflow. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.A buffer overflow vulnerability exists in the `qos_bandwidth` POST parameter.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-120
References: https://talosintelligence.com/vulnerability_reports/TALOS-2024-2049; https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-2049
CVE: CVE-2024-39802
Published: 2025-01-14
Description: Multiple buffer overflow vulnerabilities exist in the qos.cgi qos_settings() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to stack-based buffer overflow. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.A buffer overflow vulnerability exists in the `qos_dat` POST parameter.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-120
References: https://talosintelligence.com/vulnerability_reports/TALOS-2024-2049; https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-2049
CVE: CVE-2024-39803
Published: 2025-01-14
Description: Multiple buffer overflow vulnerabilities exist in the qos.cgi qos_settings() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to stack-based buffer overflow. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.A buffer overflow vulnerability exists in the `sel_mode` POST parameter.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-120
References: https://talosintelligence.com/vulnerability_reports/TALOS-2024-2049; https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-2049
CVE: CVE-2024-42444
Published: 2025-01-14
Description: APTIOV contains a vulnerability in BIOS where an attacker may cause a TOCTOU Race Condition by local means. Successful exploitation of this vulnerability may lead to execution of arbitrary code on the target device.
CVSS Score: 7.5 (HIGH)
CWE: CWE-367
References: https://go.ami.com/hubfs/Security%20Advisories/2025/AMI-SA-2025001.pdf
CVE: CVE-2024-55000
Published: 2025-01-14
Description: Sourcecodester House Rental Management system v1.0 is vulnerable to Cross Site Scripting (XSS) in rental/manage_categories.php.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/tang-0717/VUL/blob/main/House%20Rental%20Management%20system%20-%20Storage%20XSS%20on%20%28rentalmanage_categories.php%29.md; https://github.com/tang-0717/VUL/blob/main/House%20Rental%20Management%20system%20-%20Storage%20XSS%20on%20%28rentalmanage_categories.php%29.md
CVE: CVE-2024-29979
Published: 2025-01-14
Description: Improper Check for Unusual or Exceptional Conditions vulnerability in Phoenix SecureCore™ for Intel Kaby Lake, Phoenix SecureCore™ for Intel Coffee Lake, Phoenix SecureCore™ for Intel Comet Lake, Phoenix SecureCore™ for Intel Ice Lake allows Input Data Manipulation.This issue affects SecureCore™ for Intel Kaby Lake: before 4.0.1.1012; SecureCore™ for Intel Coffee Lake: before 4.1.0.568; SecureCore™ for Intel Comet Lake: before 4.2.1.292; SecureCore™ for Intel Ice Lake: before 4.2.0.334.
CVSS Score: 2.3 (LOW)
CWE: CWE-754
References: https://phoenixtech.com/phoenix-security-notifications/cve-2024-29979/
CVE: CVE-2024-29980
Published: 2025-01-14
Description: Improper Check for Unusual or Exceptional Conditions vulnerability in Phoenix SecureCore™ for Intel Kaby Lake, Phoenix SecureCore™ for Intel Coffee Lake, Phoenix SecureCore™ for Intel Comet Lake, Phoenix SecureCore™ for Intel Ice Lake allows Input Data Manipulation.This issue affects SecureCore™ for Intel Kaby Lake: before 4.0.1.1012; SecureCore™ for Intel Coffee Lake: before 4.1.0.568; SecureCore™ for Intel Comet Lake: before 4.2.1.292; SecureCore™ for Intel Ice Lake: before 4.2.0.334.
CVSS Score: 2.3 (LOW)
CWE: CWE-754
References: https://phoenixtech.com/phoenix-security-notifications/cve-2024-29980/
CVE: CVE-2025-0458
Published: 2025-01-14
Description: A vulnerability classified as problematic was found in Virtual Computer Vysual RH Solution 2024.12.1. Affected by this vulnerability is an unknown functionality of the file /index.php of the component Login Panel. The manipulation of the argument page leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-94
References: https://vuldb.com/?ctiid.291475; https://vuldb.com/?id.291475; https://vuldb.com/?submit.473865
CVE: CVE-2025-0459
Published: 2025-01-14
Description: A vulnerability, which was classified as problematic, has been found in libretro RetroArch up to 1.19.1 on Windows. Affected by this issue is some unknown functionality in the library profapi.dll of the component Startup. The manipulation leads to untrusted search path. An attack has to be approached locally. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-426
References: https://vuldb.com/?ctiid.291476; https://vuldb.com/?id.291476; https://vuldb.com/?submit.474011
CVE: CVE-2025-0460
Published: 2025-01-14
Description: A vulnerability, which was classified as critical, was found in Blog Botz for Journal Theme 1.0 on OpenCart. This affects an unknown part of the file /index.php?route=extension/module/blog_add. The manipulation of the argument image leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 7.3 (HIGH)
CWE: CWE-284, CWE-434
References: https://gist.github.com/mcdruid/[PII_REDACTED]8022a1c2b4060f74d99cd6; https://vuldb.com/?ctiid.291477; https://vuldb.com/?id.291477
CVE: CVE-2025-0461
Published: 2025-01-14
Description: A vulnerability has been found in Shanghai Lingdang Information Technology Lingdang CRM up to 8.6.0.0 and classified as problematic. This vulnerability affects unknown code of the file /crm/weixinmp/index.php?userid=123&module=Users&usid=1&action=UsersAjax&minipro_const_type=1&related_module=Singin. The manipulation of the argument pathfile leads to path traversal. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: https://github.com/BxYQ/ld/blob/main/downloadSocialPromotionQrcode_fileread.doc; https://vuldb.com/?ctiid.291478; https://vuldb.com/?id.291478
CVE: CVE-2025-22983
Published: 2025-01-14
Description: An access control issue in the component /square/getAllSquare/circle of iceCMS v2.2.0 allows unauthenticated attackers to access sensitive information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-922
References: https://github.com/H3rmesk1t/vulnerability-paper/blob/main/iceCMS-2.2.0-Incorrect%20Access%20Control.md
CVE: CVE-2025-22984
Published: 2025-01-14
Description: An access control issue in the component /api/squareComment/DelectSquareById of iceCMS v2.2.0 allows unauthenticated attackers to access sensitive information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-922
References: https://github.com/H3rmesk1t/vulnerability-paper/blob/main/iceCMS-2.2.0-Incorrect%20Access%20Control2.md
CVE: CVE-2024-10630
Published: 2025-01-14
Description: A race condition in Ivanti Application Control Engine before version 10.14.4.0 allows a local authenticated attacker to bypass the application blocking functionality.
CVSS Score: 7.8 (HIGH)
CWE: CWE-366
References: https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Application-Control-Engine-CVE-2024-10630
CVE: CVE-2024-10811
Published: 2025-01-14
Description: Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensitive information.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-36, CWE-22
References: https://forums.ivanti.com/s/article/Security-Advisory-EPM-January-2025-for-EPM-2024-and-EPM-2022-SU6; https://www.horizon3.ai/attack-research/attack-blogs/ivanti-endpoint-manager-multiple-credential-coercion-vulnerabilities/
CVE: CVE-2024-13179
Published: 2025-01-14
Description: Path Traversal in Ivanti Avalanche before version 6.4.7 allows a remote unauthenticated attacker to bypass authentication.
CVSS Score: 7.3 (HIGH)
CWE: CWE-22, CWE-288, CWE-22
References: https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Avalanche-6-4-7-Multiple-CVEs
CVE: CVE-2024-13180
Published: 2025-01-14
Description: Path Traversal in Ivanti Avalanche before version 6.4.7 allows a remote unauthenticated attacker to leak sensitive information. This CVE addresses incomplete fixes from CVE-2024-47011.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Avalanche-6-4-7-Multiple-CVEs
CVE: CVE-2024-13181
Published: 2025-01-14
Description: Path Traversal in Ivanti Avalanche before version 6.4.7 allows a remote unauthenticated attacker to bypass authentication. This CVE addresses incomplete fixes from CVE-2024-47010.
CVSS Score: 7.3 (HIGH)
CWE: CWE-22, CWE-288, CWE-22
References: https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Avalanche-6-4-7-Multiple-CVEs
CVE: CVE-2024-45627
Published: 2025-01-14
Description: In Apache Linkis <1.7.0, due to the lack of effective filtering
of parameters, an attacker configuring malicious Mysql JDBC parameters in the DataSource Manager Module will 

allow the attacker to read arbitrary files from the Linkis server. Therefore, the parameters in the Mysql JDBC URL should be blacklisted. This attack requires the attacker to obtain an authorized account from Linkis before it can be carried out. Versions of Apache Linkis < 1.7.0 will be affected. 
We recommend users upgrade the version of Linkis to version 1.7.0.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-552
References: https://lists.apache.org/thread/0zzx8lldwoqgzq98mg61hojgpvn76xsh; http://www.openwall.com/lists/oss-security/2025/01/14/1
CVE: CVE-2024-52898
Published: 2025-01-14
Description: IBM MQ 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD web console could allow a local user to obtain sensitive information when a detailed technical error message is returned.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-209
References: https://www.ibm.com/support/pages/node/7179150
CVE: CVE-2024-53561
Published: 2025-01-14
Description: A remote code execution (RCE) vulnerability in Arcadyan Meteor 2 CPE FG360 Firmware ETV2.10 allows attackers to execute arbitrary code via a crafted request.
CVSS Score: 8.7 (HIGH)
CWE: CWE-94
References: https://github.com/Mrnmap/mrnmap-cve/blob/main/CVE-2024-53561; https://www.arcadyan.com/en-us/solutions/idea/fiveG/
CVE: CVE-2024-53563
Published: 2025-01-14
Description: A stored cross-site scripting (XSS) vulnerability in Arcadyan Meteor 2 CPE FG360 Firmware ETV2.10 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/Mrnmap/mrnmap-cve/blob/main/CVE-2024-53563.; https://www.arcadyan.com/en-us/solutions/idea/fiveG/; https://github.com/Mrnmap/mrnmap-cve/blob/main/CVE-2024-53563.
CVE: CVE-2025-0462
Published: 2025-01-14
Description: A vulnerability was found in Shanghai Lingdang Information Technology Lingdang CRM up to 8.6.0.0 and classified as critical. This issue affects some unknown processing of the file /crm/weixinmp/index.php?userid=123&module=Users&usid=1&action=UsersAjax&minipro_const_type=1. The manipulation of the argument searchcontent leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/BxYQ/ld/blob/main/ListView_SQL.doc; https://vuldb.com/?ctiid.291479; https://vuldb.com/?id.291479
CVE: CVE-2025-0463
Published: 2025-01-14
Description: A vulnerability was found in Shanghai Lingdang Information Technology Lingdang CRM up to 8.6.0.0. It has been classified as critical. Affected is an unknown function of the file /crm/weixinmp/index.php?userid=123&module=Users&usid=1&action=UsersAjax&minipro_const_type=1&related_module=Singin. The manipulation of the argument name leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-284, CWE-434, CWE-434
References: https://github.com/BxYQ/ld/blob/main/File_Upload_vul.doc; https://vuldb.com/?ctiid.291480; https://vuldb.com/?id.291480
CVE: CVE-2025-0464
Published: 2025-01-14
Description: A vulnerability was found in SourceCodester Task Reminder System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the component Maintenance Section. The manipulation of the argument System Name leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://vuldb.com/?ctiid.291481; https://vuldb.com/?id.291481; https://vuldb.com/?submit.474280
CVE: CVE-2025-23080
Published: 2025-01-14
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - OpenBadges Extension allows Cross-Site Scripting (XSS).This issue affects Mediawiki - OpenBadges Extension: from 1.39.X before 1.39.11, from 1.41.X before 1.41.3, from 1.42.X before 1.42.2.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-79
References: https://gerrit.wikimedia.org/r/q/Ic9448312fa7f1cbc8feac3f852bc[PII_REDACTED]e2; https://phabricator.wikimedia.org/T381220
CVE: CVE-2025-23081
Published: 2025-01-14
Description: Cross-Site Request Forgery (CSRF), Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - DataTransfer Extension allows Cross Site Request Forgery, Cross-Site Scripting (XSS).This issue affects Mediawiki - DataTransfer Extension: from 1.39.X before 1.39.11, from 1.41.X before 1.41.3, from 1.42.X before 1.42.2.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-352
References: https://gerrit.wikimedia.org/r/c/mediawiki/extensions/DataTransfer/+/1080451; https://gerrit.wikimedia.org/r/c/mediawiki/extensions/DataTransfer/+/1093931; https://gerrit.wikimedia.org/r/q/I5e1538a3bf66378810f905834c05626e1d2c82f0
CVE: CVE-2024-12085
Published: 2025-01-14
Description: A flaw was found in rsync which could be triggered when rsync compares file checksums. This flaw allows an attacker to manipulate the checksum length (s2length) to cause a comparison between a checksum and uninitialized memory and leak one byte of uninitialized stack data at a time.
CVSS Score: 7.5 (HIGH)
CWE: CWE-908, CWE-908
References: https://access.redhat.com/errata/RHBA-2025:6470; https://access.redhat.com/errata/RHSA-2025:0324; https://access.redhat.com/errata/RHSA-2025:0325
CVE: CVE-2024-12086
Published: 2025-01-14
Description: A flaw was found in rsync. It could allow a server to enumerate the contents of an arbitrary file from the client's machine. This issue occurs when files are being copied from a client to a server. During this process, the rsync server will send checksums of local data to the client to compare with in order to determine what data needs to be sent to the server. By sending specially constructed checksum values for arbitrary files, an attacker may be able to reconstruct the data of those files byte-by-byte based on the responses from the client.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-390
References: https://access.redhat.com/errata/RHBA-2025:6470; https://access.redhat.com/security/cve/CVE-2024-12086; https://bugzilla.redhat.com/show_bug.cgi?id=2330577
CVE: CVE-2024-12087
Published: 2025-01-14
Description: A path traversal vulnerability exists in rsync. It stems from behavior enabled by the `--inc-recursive` option, a default-enabled option for many client options and can be enabled by the server even if not explicitly enabled by the client. When using the `--inc-recursive` option, a lack of proper symlink verification coupled with deduplication checks occurring on a per-file-list basis could allow a server to write files outside of the client's intended destination directory. A malicious server could write malicious files to arbitrary locations named after valid directories/paths on the client.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://access.redhat.com/errata/RHBA-2025:6470; https://access.redhat.com/errata/RHSA-2025:23154; https://access.redhat.com/errata/RHSA-2025:23235
CVE: CVE-2024-12088
Published: 2025-01-14
Description: A flaw was found in rsync. When using the `--safe-links` option, the rsync client fails to properly verify if a symbolic link destination sent from the server contains another symbolic link within it. This results in a path traversal vulnerability, which may lead to arbitrary file write outside the desired directory.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://access.redhat.com/errata/RHBA-2025:6470; https://access.redhat.com/errata/RHSA-2025:2600; https://access.redhat.com/errata/RHSA-2025:7050
CVE: CVE-2024-12747
Published: 2025-01-14
Description: A flaw was found in rsync. This vulnerability arises from a race condition during rsync's handling of symbolic links. Rsync's default behavior when encountering symbolic links is to skip them. If an attacker replaced a regular file with a symbolic link at the right time, it was possible to bypass the default behavior and traverse symbolic links. Depending on the privileges of the rsync process, an attacker could leak sensitive information, potentially leading to privilege escalation.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-362
References: https://access.redhat.com/errata/RHBA-2025:6470; https://access.redhat.com/errata/RHSA-2025:2600; https://access.redhat.com/errata/RHSA-2025:7050
CVE: CVE-2024-13158
Published: 2025-01-14
Description: An unbounded resource search path in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution.
CVSS Score: 7.2 (HIGH)
CWE: CWE-22, CWE-426
References: https://forums.ivanti.com/s/article/Security-Advisory-EPM-January-2025-for-EPM-2024-and-EPM-2022-SU6
CVE: CVE-2024-13159
Published: 2025-01-14
Description: Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensitive information.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-36
References: https://forums.ivanti.com/s/article/Security-Advisory-EPM-January-2025-for-EPM-2024-and-EPM-2022-SU6; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-13159; https://www.horizon3.ai/attack-research/attack-blogs/ivanti-endpoint-manager-multiple-credential-coercion-vulnerabilities/
CVE: CVE-2024-13160
Published: 2025-01-14
Description: Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensitive information.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-36
References: https://forums.ivanti.com/s/article/Security-Advisory-EPM-January-2025-for-EPM-2024-and-EPM-2022-SU6; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-13160; https://www.horizon3.ai/attack-research/attack-blogs/ivanti-endpoint-manager-multiple-credential-coercion-vulnerabilities/
CVE: CVE-2024-13161
Published: 2025-01-14
Description: Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensitive information.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-36
References: https://forums.ivanti.com/s/article/Security-Advisory-EPM-January-2025-for-EPM-2024-and-EPM-2022-SU6; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-13161; https://www.horizon3.ai/attack-research/attack-blogs/ivanti-endpoint-manager-multiple-credential-coercion-vulnerabilities/
CVE: CVE-2024-13162
Published: 2025-01-14
Description: SQL injection in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution. This CVE addresses incomplete fixes from CVE-2024-32848.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://forums.ivanti.com/s/article/Security-Advisory-EPM-January-2025-for-EPM-2024-and-EPM-2022-SU6
CVE: CVE-2024-13163
Published: 2025-01-14
Description: Deserialization of untrusted data in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to achieve remote code execution. Local user interaction is required.
CVSS Score: 7.8 (HIGH)
CWE: CWE-502
References: https://forums.ivanti.com/s/article/Security-Advisory-EPM-January-2025-for-EPM-2024-and-EPM-2022-SU6
CVE: CVE-2024-13164
Published: 2025-01-14
Description: An uninitialized resource in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a local authenticated attacker to escalate their privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-908
References: https://forums.ivanti.com/s/article/Security-Advisory-EPM-January-2025-for-EPM-2024-and-EPM-2022-SU6
CVE: CVE-2024-13165
Published: 2025-01-14
Description: An out-of-bounds write in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to cause a denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://forums.ivanti.com/s/article/Security-Advisory-EPM-January-2025-for-EPM-2024-and-EPM-2022-SU6
CVE: CVE-2024-13166
Published: 2025-01-14
Description: An out-of-bounds write in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to cause a denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://forums.ivanti.com/s/article/Security-Advisory-EPM-January-2025-for-EPM-2024-and-EPM-2022-SU6
CVE: CVE-2024-13167
Published: 2025-01-14
Description: An out-of-bounds write in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to cause a denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://forums.ivanti.com/s/article/Security-Advisory-EPM-January-2025-for-EPM-2024-and-EPM-2022-SU6
CVE: CVE-2024-13168
Published: 2025-01-14
Description: An out-of-bounds write in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to cause a denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://forums.ivanti.com/s/article/Security-Advisory-EPM-January-2025-for-EPM-2024-and-EPM-2022-SU6
CVE: CVE-2024-13169
Published: 2025-01-14
Description: An out-of-bounds read in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a local authenticated attacker to escalate their privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-843
References: https://forums.ivanti.com/s/article/Security-Advisory-EPM-January-2025-for-EPM-2024-and-EPM-2022-SU6