rainbutterfly/cve_corpus huggingface dataset:
CVE-2024-21960 
Incorrect default permissions in the AMD Optimizing CPU Libraries (AOCL) installation directory could allow an attacker to achieve privilege escalation potentially resulting in arbitrary code execution.
Problem types: cwe_id: CWE-276
description: CWE-276 Incorrect Default Permissions
Affected products: vendor: AMD
product: AMD Optimizing CPU Libraries (AOCL)
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.3
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Published: 2025-05-13T16:54:53.805Z
CVE-2024-21961 
Improper restriction of operations within the bounds of a memory buffer in PCIe® Link could allow an attacker with access to a guest virtual machine to potentially perform a denial of service attack against the host resulting in loss of availability.
Problem types: cwe_id: CWE-119
description: CWE-119  Improper Restriction of Operations within the Bounds of a Memory Buffer
Affected products: vendor: AMD
product: AMD EPYC™ 7002 Series Processors
default_status: affected
vendor: AMD
product: AMD Ryzen™ 5000 Series Mobile Processors with Radeon™ Graphics
default_status: affected
vendor: AMD
product: AMD Ryzen™ 7000 Series Desktop Processors
default_status: affected
vendor: AMD
product: AMD Ryzen™ 5000 Series Desktop Processors
default_status: affected
vendor: AMD
product: AMD Ryzen™ 3000 Series Desktop Processors
default_status: affected
vendor: AMD
product: AMD Ryzen™ Z1 Series Processors
default_status: affected
vendor: AMD
product: AMD Ryzen™ 7040 Series Mobile Processors with Radeon™ Graphics
default_status: affected
vendor: AMD
product: AMD Ryzen™ 8040 Series Mobile Processors with Radeon™ Graphics
default_status: affected
vendor: AMD
product: AMD Ryzen™ 8000 Series Desktop Processors
default_status: affected
vendor: AMD
product: AMD Ryzen™ 4000 Series Mobile Processors with Radeon™ Graphics
default_status: affected
vendor: AMD
product: AMD Ryzen™ 6000 Series Processors with Radeon™ Graphics
default_status: affected
vendor: AMD
product: AMD Ryzen™ 7020 Series Processors with Radeon™ Graphics
default_status: affected
vendor: AMD
product: AMD Ryzen™ 7045 Series Mobile Processors with Radeon™ Graphics
default_status: affected
vendor: AMD
product: AMD Ryzen™ 5000 Series Desktop Processors with Radeon™ Graphics
default_status: affected
vendor: AMD
product: AMD Ryzen™ 4000 Series Desktop Processors
default_status: affected
vendor: AMD
product: AMD Ryzen™ Z2 Series Processors
default_status: affected
vendor: AMD
product: AMD Ryzen™ 8040 Series Mobile Processors with Radeon™ Graphics
default_status: affected
vendor: AMD
product: AMD EPYC™ Embedded 7002 Series Processors
default_status: affected
vendor: AMD
product: AMD Ryzen™ Embedded 5000 Series Processors
default_status: affected
vendor: AMD
product: AMD Ryzen™ Embedded V2000 Series Processors
default_status: affected
vendor: AMD
product: AMD Ryzen™ Embedded V3000 Series Processors
default_status: affected
vendor: AMD
product: AMD Ryzen™ Embedded 8000 Series Processors
default_status: affected
vendor: AMD
product: AMD Ryzen™ Embedded 7000 Series Processors
default_status: affected
Published: 2026-02-12T23:45:09.575Z
CVE-2024-21962 
Improper Input Validation in the AMD RAID driver could allow an attacker to point to an arbitrary memory location potentially resulting in privilege escalation and arbitrary code execution.
Problem types: cwe_id: CWE-1220
description: CWE-1220  Insufficient Granularity of Access Control
Affected products: vendor: AMD
product: AMD EPYC™ 4005 Series Processors
default_status: affected
vendor: AMD
product: AMD EPYC™ 4004 Series Processors
default_status: affected
vendor: AMD
product: AMD Ryzen™ Threadripper™ PRO 3000 WX-Series Processors
default_status: affected
vendor: AMD
product: AMD Ryzen™ 5000 Series Mobile Processors with Radeon™ Graphics
default_status: affected
vendor: AMD
product: AMD Ryzen™ Threadripper™ 7000 WX-Series Processors
default_status: affected
vendor: AMD
product: AMD Ryzen™ 9000HX Series Processors
default_status: affected
vendor: AMD
product: AMD Ryzen™ Threadripper™ PRO 5000 WX-Series Processors
default_status: affected
vendor: AMD
product: AMD Ryzen™ 3000 Series Desktop Processors
default_status: affected
vendor: AMD
product: AMD Ryzen™ 3000 Series Mobile Processors with Radeon™ Graphics
default_status: affected
vendor: AMD
product: AMD Ryzen™ 5000 Series Desktop Processors with Radeon™ Graphics
default_status: affected
vendor: AMD
product: AMD Ryzen™ 5000 Series Desktop Processors
default_status: affected
vendor: AMD
product: AMD Ryzen™ 7040 Series Mobile Processors with Radeon™ Graphics
default_status: affected
vendor: AMD
product: AMD Ryzen™ 8040 Series Mobile Processors with Radeon™ Graphics
default_status: affected
vendor: AMD
product: AMD Ryzen™ Z2 Series Processors
default_status: affected
vendor: AMD
product: AMD Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics
default_status: affected
vendor: AMD
product: AMD Ryzen™ 4000 Series Mobile Processors with Radeon™ Graphics
default_status: affected
vendor: AMD
product: AMD Ryzen™ 6000 Series Processors with Radeon™ Graphics
default_status: affected
vendor: AMD
product: AMD Ryzen™ AI 300 Series Processors
default_status: affected
vendor: AMD
product: AMD Ryzen™ 7020 Series Processors with Radeon™ Graphics
default_status: affected
vendor: AMD
product: AMD Ryzen™ 7045 Series Mobile Processors with Radeon™ Graphics
default_status: affected
vendor: AMD
product: AMD Ryzen™ AI Max 300 Series Processors
default_status: affected
vendor: AMD
product: AMD Ryzen™ Threadripper™ 9000 Series
default_status: affected
vendor: AMD
product: AMD Ryzen™ 2000 Mobile Processors
default_status: affected
vendor: AMD
product: AMD Ryzen™ 4000 Series Desktop Processors
default_status: affected
vendor: AMD
product: AMD Ryzen™ 7000 Series Desktop Processors
default_status: affected
vendor: AMD
product: AMD Ryzen™ 8000 Series Desktop Processors
default_status: affected
vendor: AMD
product: AMD Ryzen™ 9000 Series Desktop Processors
default_status: affected
vendor: AMD
product: AMD EPYC™ Embedded 4005 Series Processors
default_status: affected
Credits: lang: en
value: Reported through AMD Bug Bounty Program
Published: 2026-05-15T01:59:01.793Z
CVE-2024-21966 
A DLL hijacking vulnerability in the AMD Ryzen™  Master Utility could allow an attacker to achieve privilege escalation, potentially resulting in arbitrary code execution.
Problem types: cwe_id: CWE-269
description: CWE-269 Improper Privilege Management
Affected products: vendor: AMD
product: AMD Ryzen™  Master Utility
default_status: unknown
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.3
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Published: 2025-02-11T19:56:25.414Z
CVE-2024-21972 

An out of bounds write vulnerability in the AMD Radeon™ user mode driver for DirectX® 11 could allow an attacker with access to a malformed shader to potentially achieve arbitrary code execution.


Problem types: cwe_id: CWE-787
description: CWE-787 Out-of-bounds Write
Affected products: vendor: AMD
product: AMD Software: Adrenalin Edition 
default_status: unknown
vendor: AMD
product: AMD Software: PRO Edition
default_status: unknown
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
version: 3.1
Published: 2024-04-23T16:36:03.933Z
CVE-2024-21974 
Improper input validation in the NPU driver could allow an attacker to supply a specially crafted pointer potentially leading to arbitrary code execution.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: AMD
product: AMD Ryzen™ AI Software
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Published: 2024-11-12T17:16:40.940Z
CVE-2024-21975 
Improper input validation in the NPU driver could allow an attacker to supply a specially crafted pointer potentially leading to arbitrary code execution.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: AMD
product: AMD Ryzen™ AI Software
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Published: 2024-11-12T17:16:51.256Z
CVE-2024-21976 
Improper input validation in the NPU driver could allow an attacker to supply a specially crafted pointer potentially leading to arbitrary code execution.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: AMD
product: AMD Ryzen™ AI Software
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Published: 2024-11-12T17:17:02.422Z
CVE-2024-21977 
Incomplete cleanup after loading a CPU microcode patch may allow a privileged attacker to degrade the entropy of the RDRAND instruction, potentially resulting in loss of integrity for SEV-SNP guests.
Problem types: cwe_id: CWE-459
description: CWE-459  Incomplete Cleanup
Affected products: vendor: AMD
product: AMD EPYC™ 7003 Series Processors
default_status: affected
vendor: AMD
product: AMD EPYC™ 9004 Series Processors
default_status: affected
vendor: AMD
product: AMD EPYC™ 8004 Series Processors
default_status: affected
vendor: AMD
product: AMD Ryzen™ Threadripper™ PRO 5000 WX-Series Processors
default_status: affected
vendor: AMD
product: AMD Ryzen™ 5000 Series Mobile Processors with Radeon™ Graphics
default_status: affected
vendor: AMD
product: AMD Ryzen™ 7035 Series Processors with Radeon™ Graphics
default_status: affected
vendor: AMD
product: AMD Ryzen™ 5000 Series Desktop Processors
default_status: affected
vendor: AMD
product: AMD Ryzen™ 7000 Series Desktop Processors
default_status: affected
vendor: AMD
product: AMD Ryzen™ 7040 Series Mobile Processors with Radeon™ Graphics
default_status: affected
vendor: AMD
product: AMD Ryzen™ 6000 Series Processors with Radeon™ Graphics
default_status: affected
vendor: AMD
product: AMD Ryzen™ 7045 Series Mobile Processors with Radeon™ Graphics
default_status: affected
vendor: AMD
product: AMD Ryzen™ Threadripper™ PRO 3000 WX-Series Processors
default_status: affected
vendor: AMD
product: AMD Ryzen™ 7030 Series Mobile Processors with Radeon™ Graphics
default_status: affected
vendor: AMD
product: AMD Ryzen™ 8000 Series Desktop Processors
default_status: affected
vendor: AMD
product: AMD EPYC™ Embedded 7003 Series Processors
default_status: affected
vendor: AMD
product: AMD EPYC™ Embedded 9004 Series Processors
default_status: affected
vendor: AMD
product: AMD Ryzen™ Embedded 8000 Series Processors
default_status: affected
vendor: AMD
product: AMD Ryzen™ Embedded 7000 Series Processors
default_status: affected
vendor: AMD
product: AMD Ryzen™ Embedded 5000 Series Processors
default_status: affected
vendor: AMD
product: AMD Ryzen™ Embedded V3000 Series Processors
default_status: affected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:N
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: CHANGED
confidentialityImpact: NONE
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 3.2
baseSeverity: LOW
Published: 2025-09-05T12:58:39.312Z
CVE-2024-21978 
Improper input validation in SEV-SNP could allow a malicious hypervisor to read or overwrite guest memory potentially leading to data leakage or data corruption.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: AMD
product: 3rd Gen AMD EPYC™ Processors
default_status: affected
vendor: AMD
product: 4th Gen AMD EPYC™ Processors
default_status: affected
vendor: AMD
product: AMD EPYC™ Embedded 7003
default_status: affected
vendor: AMD
product: AMD EPYC™ Embedded 9003
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 6
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
version: 3.1
Published: 2024-08-05T16:05:34.019Z
CVE-2024-21979 

An out of bounds write vulnerability in the AMD Radeon™ user mode driver for DirectX® 11 could allow an attacker with access to a malformed shader to potentially achieve arbitrary code execution.


Problem types: cwe_id: CWE-787
description: CWE-787 Out-of-bounds Write
Affected products: vendor: AMD
product: AMD Software: Adrenalin Edition 
default_status: unknown
vendor: AMD
product: AMD Software: PRO Edition
default_status: unknown
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
version: 3.1
Published: 2024-04-23T16:36:38.556Z
CVE-2024-21980 
Improper restriction of write operations in SNP firmware could allow a malicious hypervisor to potentially overwrite a guest's memory or UMC seed resulting in loss of confidentiality and integrity.
Problem types: cwe_id: CWE-119
description: CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
Affected products: vendor: AMD
product: 3rd Gen AMD EPYC™ Processors
default_status: affected
vendor: AMD
product: 4th Gen AMD EPYC™ Processors
default_status: affected
vendor: AMD
product: AMD EPYC™ Embedded 7003
default_status: affected
vendor: AMD
product: AMD EPYC™ Embedded 9003
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 7.9
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
version: 3.1
Published: 2024-08-05T16:06:36.216Z
CVE-2024-21981 
Improper key usage control in AMD Secure Processor
(ASP) may allow an attacker with local access who has gained arbitrary code
execution privilege in ASP to
extract ASP cryptographic keys, potentially resulting in loss of
confidentiality and integrity.
Affected products: vendor: AMD
product: AMD EPYC™ 7001 Series Processors
default_status: affected
vendor: AMD
product: AMD EPYC™ 7002 Series Processors
default_status: affected
vendor: AMD
product: AMD EPYC™ 7003 Series Processors
default_status: affected
vendor: AMD
product: AMD Ryzen™ 3000 Series Desktop Processors
default_status: affected
vendor: AMD
product: AMD Ryzen™ 5000 Series Desktop Processors
default_status: affected
vendor: AMD
product: AMD Ryzen™ 5000 Series Desktop Processor with Radeon™ Graphics
default_status: affected
vendor: AMD
product: AMD Athlon™ 3000 Series Desktop Processors with Radeon™ Graphics
default_status: affected
vendor: AMD
product: AMD Ryzen™ 4000 Series Desktop Processors with Radeon™ Graphics
default_status: affected
vendor: AMD
product: AMD Ryzen™ Threadripper™ 3000 Series Processors
default_status: affected
vendor: AMD
product: AMD Ryzen™ Threadripper™ PRO 3000WX Series Processors
default_status: affected
vendor: AMD
product: AMD Ryzen™ Threadripper™ PRO 5000WX Processors
default_status: affected
vendor: AMD
product: AMD Athlon™ 3000 Series Mobile  Processors with Radeon™ Graphics
default_status: affected
vendor: AMD
product: AMD Athlon™ 3000 Series Mobile  Processors with Radeon™ Graphics
default_status: affected
vendor: AMD
product: AMD Ryzen™ 3000 Series Mobile Processor with Radeon™ Graphics
default_status: affected
vendor: AMD
product: AMD EPYC™ Embedded 3000 Series Processors
default_status: affected
vendor: AMD
product: AMD EPYC™ Embedded 7002 Series Processors
default_status: affected
vendor: AMD
product: AMD EPYC™ Embedded 7003 Series Processors
default_status: affected
vendor: AMD
product: AMD Ryzen™ Embedded R1000 Series Processors
default_status: affected
vendor: AMD
product: AMD Ryzen™ Embedded R2000 Series Processors
default_status: affected
vendor: AMD
product: AMD Ryzen™ Embedded 5000 Series Processors
default_status: affected
vendor: AMD
product: AMD Ryzen™ Embedded V1000 Series Processors
default_status: affected
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 5.7
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N
version: 3.1
Published: 2024-08-13T16:54:58.122Z
CVE-2024-21982  CVE-2024-21982 Information Disclosure Vulnerability in ONTAP 9 
ONTAP versions 9.4 and higher are susceptible to a vulnerability 
which when successfully exploited could lead to disclosure of sensitive 
information to unprivileged attackers when the object-store profiler 
command is being run by an administrative user.


Problem types: description: 201
Affected products: vendor: NetApp
product: ONTAP 9 
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.8
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N
version: 3.1
Published: 2024-01-11T23:32:14.386Z
CVE-2024-21983 Denial of Service Vulnerability in StorageGRID (formerly StorageGRID Webscale) 
StorageGRID (formerly StorageGRID Webscale) versions prior to 11.8 
are susceptible to a Denial of Service (DoS) vulnerability. Successful 
exploit by an authenticated attacker could lead to an out of memory 
condition or node reboot.


Problem types: cwe_id: CWE-248
description: CWE-248
Affected products: vendor: NetApp
product: StorageGRID
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2024-02-16T22:35:02.365Z
CVE-2024-21984 Reflected Cross-Site Scripting Vulnerability in StorageGRID (formerly StorageGRID Webscale)
StorageGRID (formerly StorageGRID Webscale) versions prior to 11.8 
are susceptible to a difficult to exploit Reflected Cross-Site Scripting
 (XSS) vulnerability. Successful exploit requires the attacker to know 
specific information about the target instance and trick a privileged 
user into clicking a specially crafted link. This could allow the 
attacker to view or modify configuration settings or add or modify user 
accounts. 





Problem types: cwe_id: CWE-79
description: CWE-79
Affected products: vendor: NetApp
product: StorageGRID
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:N
version: 3.1
Published: 2024-02-16T22:37:47.580Z
CVE-2024-21985 Privilege Escalation Vulnerability in ONTAP 9 
ONTAP 9 versions prior to 9.9.1P18, 9.10.1P16, 9.11.1P13, 9.12.1P10 
and 9.13.1P4 are susceptible to a vulnerability which could allow an 
authenticated user with multiple remote accounts with differing roles to
 perform actions via REST API beyond their intended privilege. Possible 
actions include viewing limited configuration details and metrics or 
modifying limited settings, some of which could result in a Denial of 
Service (DoS).




Problem types: cwe_id: CWE-269
description: CWE-269 Improper Privilege Management
Affected products: vendor: NetApp
product: ONTAP 9
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.6
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
version: 3.1
Published: 2024-01-26T16:01:48.168Z
CVE-2024-21987 Improper Authorization Vulnerability in SnapCenter
SnapCenter versions 4.8 prior to 5.0 are susceptible to a 
vulnerability which could allow an authenticated SnapCenter Server user 
to modify system logging configuration settings


Problem types: cwe_id: CWE-285
description: CWE-285
Affected products: vendor: NetApp
product: SnapCenter
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
version: 3.1
Published: 2024-02-16T20:27:34.000Z
CVE-2024-21988 CVE-2024-21988 SSH Cryptographic Implementation Vulnerability in StorageGRID (formerly StorageGRID Webscale)
StorageGRID (formerly StorageGRID Webscale) versions prior to 
11.7.0.9 and 11.8.0.5 are susceptible to disclosure of sensitive 
information via complex MiTM attacks due to a vulnerability in the SSH 
cryptographic implementation.
Problem types: description: 321
Affected products: vendor: NetApp
product: StorageGRID (formerly StorageGRID Webscale)
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
version: 3.1
Published: 2024-06-14T21:37:46.450Z
CVE-2024-21989 Privilege Escalation Vulnerability in ONTAP Select Deploy administration utility
ONTAP Select Deploy administration utility versions 9.12.1.x, 
9.13.1.x and 9.14.1.x are susceptible to a vulnerability which when 
successfully exploited could allow a read-only user to escalate their 
privileges.


Problem types: cwe_id: CWE-269
description: CWE-269 Improper Privilege Management
Affected products: vendor: NetApp
product: ONTAP Select Deploy administration utility
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
version: 3.1
Published: 2024-04-17T19:32:34.598Z