rainbutterfly/cve_corpus huggingface dataset:
CVE-2024-21990 Default Privileged Account Credentials Vulnerability in ONTAP Select Deploy administration utility
ONTAP Select Deploy administration utility versions 9.12.1.x, 
9.13.1.x and 9.14.1.x contain hard-coded credentials that could allow an
 attacker to view Deploy configuration information and modify the 
account credentials.





Problem types: cwe_id: CWE-259
description: CWE-259
Affected products: vendor: NetApp
product: ONTAP Select Deploy administration utility
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
version: 3.1
Published: 2024-04-17T19:35:23.599Z
CVE-2024-21993 Information Disclosure Vulnerability in SnapCenter
SnapCenter versions prior to 5.0p1 are susceptible to a vulnerability
 which could allow an authenticated attacker to discover plaintext 
credentials.
Problem types: description: 313
Affected products: vendor: NetApp
product: SnapCenter
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.7
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
version: 3.1
Published: 2024-07-09T21:26:03.404Z
CVE-2024-21994 CVE-2024-21994 Denial of Service Vulnerability in StorageGRID (formerly StorageGRID Webscale)
StorageGRID (formerly StorageGRID Webscale) versions prior to 11.9 are susceptible to a Denial of Service (DoS) vulnerability. Successful exploit by an authenticated attacker could lead to a service crash.
Problem types: description: 789
Affected products: vendor: NetApp
product: StorageGRID
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
version: 3.1
Published: 2024-11-08T21:06:32.380Z
CVE-2024-22002 
CORSAIR iCUE 5.9.105 with iCUE Murals on Windows allows unprivileged users to insert DLL files in the cuepkg-1.2.6 subdirectory of the installation directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-06-18T00:00:00.000Z
CVE-2024-22004 Unchecked length in Trusted Application on Google Nest Wifi Pro, leading to out of bounds read
Due to length check, an attacker with privilege access on a Linux Nonsecure operating system can trigger a vulnerability and leak the secure memory from the Trusted Application

Problem types: cwe_id: CWE-125
description: CWE-125 Out-of-bounds Read
Affected products: vendor: Google
product: Nest Wifi Pro
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 10
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Published: 2024-04-05T18:03:23.151Z
CVE-2024-22005 
there is a possible Authentication Bypass due to improperly used crypto. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Problem types: description: Elevation of privilege
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2024-03-11T18:55:34.794Z
CVE-2024-22006 
OOB read in the TMU plugin that allows for memory disclosure in the power management subsystem of the device.
Problem types: description: Information disclosure
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2024-03-11T18:55:34.950Z
CVE-2024-22007 
In constraint_check of fvp.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
Problem types: description: Information disclosure
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2024-03-11T18:55:35.107Z
CVE-2024-22008 
In config_gov_time_windows of tmu.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Problem types: description: Elevation of privilege
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2024-03-11T18:55:35.260Z
CVE-2024-22009 
In init_data of , there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Problem types: description: Elevation of privilege
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2024-03-11T18:55:35.419Z
CVE-2024-22010 
In dvfs_plugin_caller of fvp.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
Problem types: description: Information disclosure
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2024-03-11T18:55:35.566Z
CVE-2024-22011 
In ss_ProcessRejectComponent of ss_MmConManagement.c, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
Problem types: description: Information disclosure
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2024-03-11T18:55:35.717Z
CVE-2024-22012 
there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.


Problem types: description: Elevation of privilege
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2024-02-07T15:49:18.359Z
CVE-2024-22013 
U-Boot environment is read from unauthenticated partition.
Problem types: description: Elevation of privilege
Affected products: vendor: Google
product: Nest Wifi Pro
default_status: unaffected
Published: 2024-09-16T19:52:33.764Z
CVE-2024-22014 
An issue discovered in 360 Total Security Antivirus through 11.0.0.1061 for Windows allows attackers to gain escalated privileges via Symbolic Link Follow to Arbitrary File Delete.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-15T00:00:00.000Z
CVE-2024-22015 
Improper input validation for some Intel(R) DLB driver software before version 8.5.0 may allow an authenticated user to potentially denial of service via local access.
Problem types: description: denial of service
cwe_id: CWE-20
description: Improper input validation
Affected products: vendor: n/a
product: Intel(R) DLB driver software
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 6.5
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: CHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
Published: 2024-05-16T20:47:36.565Z
CVE-2024-22016 Incorrect Permission Assignment for Critical Resource in Rapid SCADA
In Rapid Software LLC's Rapid SCADA versions prior to Version 5.8.4, an authorized user can write directly to the Scada directory. This may allow privilege escalation.

Problem types: cwe_id: CWE-732
description: CWE-732 Incorrect Permission Assignment for Critical Resource
Affected products: vendor: Rapid Software LLC
product: Rapid SCADA
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Noam Moshe of Claroty Research reported these vulnerabilities to CISA.
Published: 2024-02-01T23:19:59.311Z
CVE-2024-22017 
setuid() does not affect libuv's internal io_uring operations if initialized before the call to setuid().
This allows the process to perform privileged operations despite presumably having dropped such privileges through a call to setuid().
This vulnerability affects all users using version greater or equal than Node.js 18.18.0, Node.js 20.4.0 and Node.js 21.
Affected products: vendor: NodeJS
product: Node
default_status: unaffected
Published: 2024-03-19T04:32:34.137Z
CVE-2024-22018 
A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-read flag is used.
This flaw arises from an inadequate permission model that fails to restrict file stats through the fs.lstat API. As a result, malicious actors can retrieve stats from files that they do not have explicit read access to.
This vulnerability affects all users using the experimental permission model in Node.js 20 and Node.js 21.
Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.
Affected products: vendor: NodeJS
product: Node
default_status: unaffected
Published: 2024-07-10T01:00:12.747Z
CVE-2024-22019 
A vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP request with chunked encoding, leading to resource exhaustion and denial of service (DoS). The server reads an unbounded number of bytes from a single connection, exploiting the lack of limitations on chunk extension bytes. The issue can cause CPU and network bandwidth exhaustion, bypassing standard safeguards like timeouts and body size limits.
Affected products: vendor: NodeJS
product: Node
default_status: unaffected
Published: 2024-02-20T01:31:08.092Z
CVE-2024-22020 
A security flaw in Node.js  allows a bypass of network import restrictions.
By embedding non-network imports in data URLs, an attacker can execute arbitrary code, compromising system security.
Verified on various platforms, the vulnerability is mitigated by forbidding data URLs in network imports.
Exploiting this flaw can violate network import security, posing a risk to developers and servers.
Affected products: vendor: NodeJS
product: Node
default_status: unaffected
Published: 2024-07-09T01:07:28.098Z
CVE-2024-22021 
Vulnerability CVE-2024-22021 allows a Veeam Recovery Orchestrator user with a low privileged role (Plan Author) to retrieve plans from a Scope other than the one they are assigned to. 

Affected products: vendor: Veeam
product: Recovery Orchestrator 
vendor: Veeam
product: Disaster Recovery Orchestrator
vendor: Veeam
product: Availability Orchestrator
vendor: Veeam
product: Recovery Orchestrator
Published: 2024-02-07T00:53:30.493Z
CVE-2024-22022 
Vulnerability CVE-2024-22022 allows a Veeam Recovery Orchestrator user that has been assigned a low-privileged role to access the NTLM hash of the service account used by the Veeam Orchestrator Server Service.
Affected products: vendor: Veeam
product: Recovery Orchestrator
vendor: Veeam
product: Availability Orchestrator
Published: 2024-02-07T00:53:30.523Z
CVE-2024-22023 
An XML entity expansion or XEE vulnerability in SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure allows an unauthenticated attacker to send specially crafted XML requests in-order-to temporarily cause resource exhaustion thereby resulting in a limited-time DoS. 
Affected products: vendor: Ivanti
product: Connect Secure
default_status: unaffected
vendor: Ivanti
product: Policy Secure
default_status: unaffected
Published: 2024-04-04T19:45:10.162Z
CVE-2024-22024 
An XML external entity or XXE vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x), Ivanti Policy Secure (9.x, 22.x) and ZTA gateways which allows an attacker to access certain restricted resources without authentication.
Affected products: vendor: Ivanti
product: ICS
vendor: Ivant 
product: ICS
vendor: Ivanti
product: IPS
Published: 2024-02-13T04:07:04.355Z
CVE-2024-22025 
A vulnerability in Node.js has been identified, allowing for a Denial of Service (DoS) attack through resource exhaustion when using the fetch() function to retrieve content from an untrusted URL.
The vulnerability stems from the fact that the fetch() function in Node.js always decodes Brotli, making it possible for an attacker to cause resource exhaustion when fetching content from an untrusted URL.
An attacker controlling the URL passed into fetch() can exploit this vulnerability to exhaust memory, potentially leading to process termination, depending on the system configuration.
Affected products: vendor: NodeJS
product: Node
default_status: unaffected
Published: 2024-03-19T04:32:34.211Z
CVE-2024-22026 
A local privilege escalation vulnerability in EPMM before 12.1.0.0 allows an authenticated local user to bypass shell restriction and execute arbitrary commands on the appliance.
Affected products: vendor: Ivanti
product: EPMM
default_status: unaffected
Published: 2024-05-22T22:55:11.219Z
CVE-2024-22027 
Improper input validation vulnerability in WordPress Quiz Maker Plugin prior to 6.5.0.6 allows a remote authenticated attacker to perform a Denial of Service (DoS) attack against external services.
Problem types: description: Improper input validation
Affected products: vendor: AYS Pro Plugins
product: WordPress Quiz Maker Plugin
Published: 2024-01-12T06:41:29.452Z
CVE-2024-22028 
Insufficient technical documentation issue exists in thermal camera TMC series all firmware versions. The user of the affected product is not aware of the internally saved data. By accessing the affected product physically, an attacker may retrieve the internal data.
Problem types: description: Insufficient verification of data authenticity
Affected products: vendor: THREE R SOLUTION CORP. JAPAN
product: 3R-TMC01
vendor: THREE R SOLUTION CORP. JAPAN
product: 3R-TMC02
vendor: THREE R SOLUTION CORP. JAPAN
product: 3R-TMC03
vendor: THREE R SOLUTION CORP. JAPAN
product: 3R-TMC04
vendor: THREE R SOLUTION CORP. JAPAN
product: 3R-TMC05
vendor: THREE R SOLUTION CORP. JAPAN
product: 3R-TMC06
Published: 2024-01-15T06:53:27.089Z
CVE-2024-22029 tomcat packaging allows for escalation to root from tomcat user
Insecure permissions in the packaging of tomcat allow local users that win a race during package installation to escalate to root
Problem types: cwe_id: CWE-732
description: CWE-732: Incorrect Permission Assignment for Critical Resource
Affected products: vendor: SUSE
product: Container suse/manager/5.0/x86_64/server:5.0.0-beta1.2.122
default_status: unaffected
vendor: SUSE
product: SUSE Enterprise Storage 7.1
default_status: unaffected
vendor: SUSE
product: SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS
default_status: unaffected
vendor: SUSE
product: SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS
default_status: unaffected
vendor: SUSE
product: SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS
default_status: unaffected
vendor: SUSE
product: SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS
default_status: unaffected
vendor: SUSE
product: SUSE Linux Enterprise High Performance Computing 15 SP5
default_status: unaffected
vendor: SUSE
product: SUSE Linux Enterprise Module for Web and Scripting 15 SP5
default_status: unaffected
vendor: SUSE
product: SUSE Linux Enterprise Server 15 SP5
default_status: unaffected
vendor: SUSE
product: SUSE Linux Enterprise Server for SAP Applications 15 SP5
default_status: unaffected
vendor: SUSE
product: SUSE Linux Enterprise High Performance Computing 15 SP6
default_status: unaffected
vendor: SUSE
product: SUSE Linux Enterprise Module for Web and Scripting 15 SP6
default_status: unaffected
vendor: SUSE
product: SUSE Linux Enterprise Server 15 SP6
default_status: unaffected
vendor: SUSE
product: SUSE Linux Enterprise Server for SAP Applications 15 SP6
default_status: unaffected
vendor: SUSE
product: SUSE Linux Enterprise Server 15 SP2-LTSS
default_status: unaffected
vendor: SUSE
product: SUSE Linux Enterprise Server 15 SP3-LTSS
default_status: unaffected
vendor: SUSE
product: SUSE Linux Enterprise Server 15 SP4-LTSS
default_status: unaffected
vendor: SUSE
product: SUSE Linux Enterprise Server for SAP Applications 15 SP2
default_status: unaffected
vendor: SUSE
product: SUSE Linux Enterprise Server for SAP Applications 15 SP3
default_status: unaffected
vendor: SUSE
product: SUSE Linux Enterprise Server for SAP Applications 15 SP4
default_status: unaffected
vendor: SUSE
product: SUSE Manager Server 4.3
default_status: unaffected
vendor: SUSE
product: openSUSE Leap 15.5
default_status: unaffected
vendor: SUSE
product: openSUSE Tumbleweed
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Johannes Segitz of SUSE
Published: 2024-10-16T13:20:47.698Z
CVE-2024-22030 Rancher agents can be hijacked by taking over the Rancher Server URL
A vulnerability has been identified within Rancher that can be exploited
 in narrow circumstances through a man-in-the-middle (MITM) attack. An 
attacker would need to have control of an expired domain or execute a 
DNS spoofing/hijacking attack against the domain to exploit this 
vulnerability. The targeted domain is the one used as the Rancher URL.
Problem types: cwe_id: CWE-295
description: CWE-295: Improper Certificate Validation
Affected products: vendor: SUSE
product: rancher
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Jarkko Vesiluoma from Redtest Security
Published: 2024-10-16T13:24:06.944Z
CVE-2024-22032 Rancher's RKE1 Encryption Config kept in plain-text within cluster AppliedSpec
A vulnerability has been identified in which an RKE1 cluster keeps 
constantly reconciling when secrets encryption configuration is enabled.
 When reconciling, the Kube API secret values are written in plaintext 
on the AppliedSpec. Cluster owners, Cluster members, and Project members
 (for projects within the cluster), all have RBAC permissions to view 
the cluster object from the apiserver.
Problem types: cwe_id: CWE-200
description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: SUSE
product: rancher
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2024-10-16T13:26:01.883Z
CVE-2024-22033 obs-service-download_url is vulnerable to argument injection
The OBS service obs-service-download_url was vulnerable to a command injection vulnerability. The attacker could provide a configuration to the service that allowed to execute command in later steps
Problem types: cwe_id: CWE-78
description: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: SUSE
product: SUSE Package Hub 15 SP5
default_status: unaffected
vendor: SUSE
product: SUSE Package Hub 15 SP6
default_status: unaffected
vendor: SUSE
product: openSUSE Leap 15.5
default_status: unaffected
vendor: SUSE
product: openSUSE Leap 15.6
default_status: unaffected
vendor: SUSE
product: openSUSE Tumbleweed
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Maxime Rinaudo
Published: 2024-10-16T13:42:46.559Z
CVE-2024-22034 Crafted projects can overwrite special files in the .osc config directory
Attackers could put the special files in .osc into the actual package sources (e.g. _apiurl). This allows the attacker to change the configuration of osc for the victim
Affected products: vendor: SUSE
product: SUSE Linux Enterprise Desktop 15 SP5
default_status: unaffected
vendor: SUSE
product: SUSE Linux Enterprise High Performance Computing 15 SP5
default_status: unaffected
vendor: SUSE
product: SUSE Linux Enterprise Module for Development Tools 15 SP5
default_status: unaffected
vendor: SUSE
product: SUSE Linux Enterprise Server 15 SP5
default_status: unaffected
vendor: SUSE
product: SUSE Linux Enterprise Server for SAP Applications 15 SP5
default_status: unaffected
vendor: SUSE
product: SUSE Linux Enterprise Desktop 15 SP6
default_status: unaffected
vendor: SUSE
product: SUSE Linux Enterprise High Performance Computing 15 SP6
default_status: unaffected
vendor: SUSE
product: SUSE Linux Enterprise Module for Development Tools 15 SP6
default_status: unaffected
vendor: SUSE
product: SUSE Linux Enterprise Server 15 SP6
default_status: unaffected
vendor: SUSE
product: SUSE Linux Enterprise Server for SAP Applications 15 SP6
default_status: unaffected
vendor: SUSE
product: SUSE Linux Enterprise Server 12 SP5
default_status: unaffected
vendor: SUSE
product: SUSE Linux Enterprise Server for SAP Applications 12 SP5
default_status: unaffected
vendor: SUSE
product: SUSE Linux Enterprise Software Development Kit 12 SP5
default_status: unaffected
vendor: SUSE
product: openSUSE Leap 15.5
default_status: unaffected
vendor: SUSE
product: openSUSE Leap 15.6
default_status: unaffected
vendor: SUSE
product: openSUSE Tumbleweed
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
version: 3.1
Credits: lang: en
value: Daniel Mach of SUSE
Published: 2024-10-16T13:46:08.416Z
CVE-2024-22036 Rancher Remote Code Execution via Cluster/Node Drivers
A vulnerability has been identified within Rancher where a cluster or node driver can be used to escape the chroot
 jail and gain root access to the Rancher container itself. In 
production environments, further privilege escalation is possible based 
on living off the land within the Rancher container itself. For the test
 and development environments, based on a –privileged Docker container, 
it is possible to escape the Docker container and gain execution access 
on the host system.


This issue affects rancher: from 2.7.0 before 2.7.16, from 2.8.0 before 2.8.9, from 2.9.0 before 2.9.3.
Problem types: cwe_id: CWE-269
description: CWE-269: Improper Privilege Management
Affected products: vendor: SUSE
product: rancher
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.1
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Published: 2025-04-16T08:37:54.218Z