rainbutterfly/cve_corpus huggingface dataset:
CVE-2024-26270 
The Account Settings page in Liferay Portal 7.4.3.76 through 7.4.3.99, and Liferay DXP 2023.Q3 before patch 5, and 7.4 update 76 through 92 embeds the user’s hashed password in the page’s HTML source, which allows man-in-the-middle attackers to steal a user's hashed password.
Problem types: cwe_id: CWE-201
description: CWE-201 Insertion of Sensitive Information Into Sent Data
Affected products: vendor: Liferay
product: Portal
default_status: unaffected
vendor: Liferay
product: DXP
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2024-02-20T13:43:46.074Z
CVE-2024-26271 
Cross-site request forgery (CSRF) vulnerability in the My Account widget in Liferay Portal 7.4.3.75 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.2, 2023.Q3.1 through 2023.Q3.5, 7.4 update 75 through update 92 and 7.3 update 32 through update 36 allows remote attackers to (1) change user passwords, (2) shut down the server, (3) execute arbitrary code in the scripting console, (4) and perform other administrative actions via the _com_liferay_my_account_web_portlet_MyAccountPortlet_backURL parameter.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Liferay
product: Portal
default_status: unaffected
vendor: Liferay
product: DXP
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Published: 2024-10-22T14:06:16.533Z
CVE-2024-26272 
Cross-site request forgery (CSRF) vulnerability in the content page editor in Liferay Portal 7.3.2 through 7.4.3.107, and Liferay DXP 2023.Q4.0 through 2023.Q4.2, 2023.Q3.1 through 2023.Q3.5, 7.4 GA through update 92 and 7.3 GA through update 35 allows remote attackers to (1) change user passwords, (2) shut down the server, (3) execute arbitrary code in the scripting console, (4) and perform other administrative actions via the p_l_back_url parameter.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Liferay
product: Portal
default_status: unaffected
vendor: Liferay
product: DXP
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Published: 2024-10-22T14:50:41.505Z
CVE-2024-26273 
Cross-site request forgery (CSRF) vulnerability in the content page editor in Liferay Portal 7.4.0 through 7.4.3.103, and Liferay DXP 2023.Q4.0 through 2023.Q4.2, 2023.Q3.1 through 2023.Q3.5, 7.4 GA through update 92 and 7.3 update 29 through update 35 allows remote attackers to (1) change user passwords, (2) shut down the server, (3) execute arbitrary code in the scripting console, (4) and perform other administrative actions via the _com_liferay_commerce_catalog_web_internal_portlet_CommerceCatalogsPortlet_redirect parameter.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Liferay
product: Portal
default_status: unaffected
vendor: Liferay
product: DXP
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Published: 2024-10-22T15:01:29.395Z
CVE-2024-26275 
A vulnerability has been identified in JT2Go (All versions < V2312.0004), Parasolid V35.1 (All versions < V35.1.254), Parasolid V36.0 (All versions < V36.0.207), Parasolid V36.1 (All versions < V36.1.147), Teamcenter Visualization V14.2 (All versions < V14.2.0.12), Teamcenter Visualization V14.3 (All versions < V14.3.0.9), Teamcenter Visualization V2312 (All versions < V2312.0004). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted X_T files. This could allow an attacker to execute code in the context of the current process.
Problem types: cwe_id: CWE-125
description: CWE-125: Out-of-bounds Read
Affected products: vendor: Siemens
product: JT2Go
default_status: unknown
vendor: Siemens
product: Parasolid V35.1
default_status: unknown
vendor: Siemens
product: Parasolid V36.0
default_status: unknown
vendor: Siemens
product: Parasolid V36.1
default_status: unknown
vendor: Siemens
product: Teamcenter Visualization V14.2
default_status: unknown
vendor: Siemens
product: Teamcenter Visualization V14.3
default_status: unknown
vendor: Siemens
product: Teamcenter Visualization V2312
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
baseScore: 7.8
baseSeverity: HIGH
Published: 2024-04-09T08:34:36.604Z
CVE-2024-26276 
A vulnerability has been identified in JT2Go (All versions < V2312.0004), Parasolid V35.1 (All versions < V35.1.254), Parasolid V36.0 (All versions < V36.0.207), Parasolid V36.1 (All versions < V36.1.147), Teamcenter Visualization V14.2 (All versions < V14.2.0.12), Teamcenter Visualization V14.3 (All versions < V14.3.0.9), Teamcenter Visualization V2312 (All versions < V2312.0004). The affected application contains a stack exhaustion vulnerability while parsing a specially crafted X_T file. This could allow an attacker to cause denial of service condition.
Problem types: cwe_id: CWE-770
description: CWE-770: Allocation of Resources Without Limits or Throttling
Affected products: vendor: Siemens
product: JT2Go
default_status: unknown
vendor: Siemens
product: Parasolid V35.1
default_status: unknown
vendor: Siemens
product: Parasolid V36.0
default_status: unknown
vendor: Siemens
product: Parasolid V36.1
default_status: unknown
vendor: Siemens
product: Teamcenter Visualization V14.2
default_status: unknown
vendor: Siemens
product: Teamcenter Visualization V14.3
default_status: unknown
vendor: Siemens
product: Teamcenter Visualization V2312
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
baseScore: 3.3
baseSeverity: LOW
Published: 2024-04-09T08:34:37.744Z
CVE-2024-26277 
A vulnerability has been identified in JT2Go (All versions < V2312.0004), Parasolid V35.1 (All versions < V35.1.254), Parasolid V36.0 (All versions < V36.0.207), Parasolid V36.1 (All versions < V36.1.147), Teamcenter Visualization V14.2 (All versions < V14.2.0.12), Teamcenter Visualization V14.3 (All versions < V14.3.0.9), Teamcenter Visualization V2312 (All versions < V2312.0004). The affected applications contain a null pointer dereference vulnerability while parsing specially crafted X_T files. An attacker could leverage this vulnerability to crash the application causing denial of service condition.
Problem types: cwe_id: CWE-476
description: CWE-476: NULL Pointer Dereference
Affected products: vendor: Siemens
product: JT2Go
default_status: unknown
vendor: Siemens
product: Parasolid V35.1
default_status: unknown
vendor: Siemens
product: Parasolid V36.0
default_status: unknown
vendor: Siemens
product: Parasolid V36.1
default_status: unknown
vendor: Siemens
product: Teamcenter Visualization V14.2
default_status: unknown
vendor: Siemens
product: Teamcenter Visualization V14.3
default_status: unknown
vendor: Siemens
product: Teamcenter Visualization V2312
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
baseScore: 3.3
baseSeverity: LOW
Published: 2024-04-09T08:34:38.896Z
CVE-2024-26278 [20240705] - Core - XSS in com_fields default field value
The Custom Fields component not correctly filter inputs, leading to a XSS vector.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Joomla! Project
product: Joomla! CMS
default_status: unaffected
Credits: lang: en
value: Jesper den Boer
Published: 2024-07-09T16:15:44.821Z
CVE-2024-26279 [20240704] - Core - XSS in Wrapper extensions
The wrapper extensions do not correctly validate inputs, leading to XSS vectors.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Joomla! Project
product: Joomla! CMS
default_status: unaffected
Credits: lang: en
value: Jesper den Boer
Published: 2024-07-09T16:15:48.485Z
CVE-2024-26280 Apache Airflow: Overly broad default permissions for Viewer/Ops (audit logs)
Apache Airflow, versions before 2.8.2, has a vulnerability that allows authenticated Ops and Viewers users to view all information on audit logs, including dag names and usernames they were not permitted to view. With 2.8.2 and newer, Ops and Viewer users do not have audit log permission by default, they need to be explicitly granted permissions to see the logs. Only admin users have audit log permission by default.

Users of Apache Airflow are recommended to upgrade to version 2.8.2 or newer to mitigate the risk associated with this vulnerability
Problem types: cwe_id: CWE-276
description: CWE-276 Incorrect Default Permissions
Affected products: vendor: Apache Software Foundation
product: Apache Airflow
default_status: unaffected
Credits: lang: en
value: Yusuf AYDIN (@h1_yusuf)
Published: 2024-03-01T11:05:54.480Z
CVE-2024-26281 
Upon scanning a JavaScript URI with the QR code scanner, an attacker could have executed unauthorized scripts on the current top origin sites in the URL bar. This vulnerability affects Firefox for iOS < 123.
Problem types: description: QR code scanner allowed executing a JavaScript URI
Affected products: vendor: Mozilla
product: Firefox for iOS
Credits: lang: en
value: James Lee
Published: 2024-02-22T14:56:45.803Z
CVE-2024-26282 
Using an AMP url with a canonical element, an attacker could have executed JavaScript from an opened bookmarked page. This vulnerability affects Firefox for iOS < 123.
Problem types: description: UXSS through a canonical element
Affected products: vendor: Mozilla
product: Firefox for iOS
Credits: lang: en
value: Muneaki Nishimura
Published: 2024-02-22T14:56:44.758Z
CVE-2024-26283 
An attacker could have executed unauthorized scripts on top origin sites using a JavaScript URI when opening an external URL with a custom Firefox scheme. This vulnerability affects Firefox for iOS < 123.
Problem types: description: Address bar spoofing using Firefox custom open URL scheme
Affected products: vendor: Mozilla
product: Firefox for iOS
Credits: lang: en
value: Muneaki Nishimura
Published: 2024-02-22T14:56:43.860Z
CVE-2024-26284 
Utilizing a 302 redirect, an attacker could have conducted a Universal Cross-Site Scripting (UXSS) on a victim website, if the victim had a link to the attacker's website. This vulnerability affects Focus for iOS < 123.
Problem types: description: UXSS exploit via 302 Redirect
Affected products: vendor: Mozilla
product: Focus for iOS
Credits: lang: en
value: James Lee
Published: 2024-02-22T14:56:42.004Z
CVE-2024-26288 PHOENIX CONTACT: Lack of SSL support in CHARX Series
An unauthenticated remote attacker can influence the communication due to the lack of encryption of sensitive data via a MITM. Charging is not affected.
Problem types: cwe_id: CWE-319
description: CWE-319 Cleartext Transmission of Sensitive Information
Affected products: vendor: PHOENIX CONTACT
product: CHARX SEC-3000
default_status: unaffected
vendor: PHOENIX CONTACT
product: CHARX SEC-3050
default_status: unaffected
vendor: PHOENIX CONTACT
product: CHARX SEC-3100
default_status: unaffected
vendor: PHOENIX CONTACT
product: CHARX SEC-3150
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 8.7
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
version: 3.1
Credits: lang: en
value: Chris Anastasio 
lang: en
value: Fabius Watson
Published: 2024-03-12T08:13:05.195Z
CVE-2024-26289 Remote Code Inclusion Vulnerability in Multiple PMB Versions
Deserialization of Untrusted Data vulnerability in PMB Services PMB allows Remote Code Inclusion.This issue affects PMB: from 7.5.1 before 7.5.6-2, from 7.4.1 before 7.4.9, from 7.3.1 before 7.3.18.
Problem types: cwe_id: CWE-502
description: CWE-502 Deserialization of Untrusted Data
Affected products: vendor: PMB Services
product: PMB
default_status: unknown
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Johan Caluwe from CCB / CERT.be
lang: en
value: ANSSI / CERT-FR
Published: 2024-05-27T07:01:52.386Z
CVE-2024-26290 Authenticated Remote Command Injection affecting Avid NEXIS
Improper Input Validation vulnerability in Avid Avid NEXIS E-series on Linux, Avid Avid NEXIS F-series on Linux, Avid Avid NEXIS PRO+ on Linux, Avid System Director Appliance (SDA+) on Linux allows code execution on underlying operating system with root permissions.This issue affects Avid NEXIS E-series: before 2024.6.0; Avid NEXIS F-series: before 2024.6.0; Avid NEXIS PRO+: before 2024.6.0; System Director Appliance (SDA+): before 2024.6.0.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Avid
product: Avid NEXIS E-series
default_status: unaffected
vendor: Avid
product: Avid NEXIS F-series
default_status: unaffected
vendor: Avid
product: Avid NEXIS PRO+
default_status: unaffected
vendor: Avid
product: System Director Appliance (SDA+)
default_status: unaffected
Credits: lang: en
value: DriveByte
Published: 2025-03-12T19:45:08.869Z
CVE-2024-26291 Authenticated Arbitrary File Read affecting Avid NEXIS
An Unauthenticated Arbitrary File Read vulnerability affects the
Agent when installed on a system. The parameter filename does not validate the
path thus allowing users to read arbitrary files. As
the application runs with the highest privileges (root/NT_AUTHORITY SYSTEM)
by default attackers are able to obtain sensitive information.

This issue affects Avid NEXIS E-series: before 2025.5.1; Avid NEXIS F-series: before 2025.5.1; Avid NEXIS PRO+: before 2025.5.1; System Director Appliance (SDA+): before 2025.5.1.
Problem types: cwe_id: CWE-285
description: CWE-285: Improper Authorization
Affected products: vendor: Avid
product: Avid NEXIS E-series
default_status: unaffected
vendor: Avid
product: Avid NEXIS F-series
default_status: unaffected
vendor: Avid
product: Avid NEXIS PRO+
default_status: unaffected
vendor: Avid
product: System Director Appliance (SDA+)
default_status: unaffected
Credits: lang: en
value: DriveByte
lang: en
value: CERT-Bund
Published: 2025-07-14T08:12:16.139Z
CVE-2024-26292 Authenticated Arbitrary File Deletion affecting Avid NEXIS
An authenticated Arbitrary File Deletion vulnerability enables an attacker to delete critical files.
This issue affects Avid NEXIS E-series: before 2025.5.1; Avid NEXIS F-series: before 2025.5.1; Avid NEXIS PRO+: before 2025.5.1; System Director Appliance (SDA+): before 2025.5.1.
Problem types: cwe_id: CWE-22
description: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Avid
product: Avid NEXIS E-series
default_status: unaffected
vendor: Avid
product: Avid NEXIS F-series
default_status: unaffected
vendor: Avid
product: Avid NEXIS PRO+
default_status: unaffected
vendor: Avid
product: System Director Appliance (SDA+)
default_status: unaffected
Credits: lang: en
value: DriveByte
lang: en
value: CERT-Bund
Published: 2025-07-14T08:19:58.940Z
CVE-2024-26293 Unauthenticated Path Traversal affecting Avid NEXIS
The Avid Nexis Agent uses a vulnerable gSOAP
version. An undocumented vulnerability impacting gSOAP v2.8 makes the application vulnerable to an Unauthenticated Path Traversal vulnerability.
This issue affects Avid NEXIS E-series: before 2025.5.1; Avid NEXIS F-series: before 2025.5.1; Avid NEXIS PRO+: before 2025.5.1; System Director Appliance (SDA+): before 2025.5.1.
Problem types: cwe_id: CWE-1395
description: CWE-1395: Dependency on Vulnerable Third-Party Component
Affected products: vendor: Avid
product: Avid NEXIS E-series
default_status: unaffected
vendor: Avid
product: Avid NEXIS F-series
default_status: unaffected
vendor: Avid
product: Avid NEXIS PRO+
default_status: unaffected
vendor: Avid
product: System Director Appliance (SDA+)
default_status: unaffected
Credits: lang: en
value: DriveByte
lang: en
value: CERT-Bund
Published: 2025-07-14T09:18:18.045Z
CVE-2024-26294 
Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete system compromise.


Affected products: vendor: Hewlett Packard Enterprise (HPE)
product: Aruba ClearPass Policy Manager
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Daniel Jensen (@dozernz)
Published: 2024-02-27T21:54:21.857Z
CVE-2024-26295 
Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete system compromise.


Affected products: vendor: Hewlett Packard Enterprise (HPE)
product: Aruba ClearPass Policy Manager
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Daniel Jensen (@dozernz)
Published: 2024-02-27T21:56:22.295Z
CVE-2024-26296 
Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete system compromise.


Affected products: vendor: Hewlett Packard Enterprise (HPE)
product: Aruba ClearPass Policy Manager
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Kajetan Rostojek (@kaje11)
Published: 2024-02-27T21:57:24.846Z
CVE-2024-26297 
Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete system compromise.


Affected products: vendor: Hewlett Packard Enterprise (HPE)
product: Aruba ClearPass Policy Manager
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Kajetan Rostojek (@kaje11)
Published: 2024-02-27T22:03:55.507Z
CVE-2024-26298 
Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete system compromise.


Affected products: vendor: Hewlett Packard Enterprise (HPE)
product: Aruba ClearPass Policy Manager
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Kajetan Rostojek (@kaje11)
Published: 2024-02-27T22:04:58.511Z
CVE-2024-26299 
A vulnerability in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS) attack against an administrative user of the interface. A successful exploit allows an attacker to execute arbitrary script code in a victim's browser in the context of the affected interface.


Affected products: vendor: Hewlett Packard Enterprise (HPE)
product: Aruba ClearPass Policy Manager
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.6
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: S4thi5h
Published: 2024-02-27T22:05:37.624Z
CVE-2024-26300 
A vulnerability in the guest interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS) attack against an administrative user of the interface. A successful exploit allows an attacker to execute arbitrary script code in a victim's browser in the context of the affected interface.


Affected products: vendor: Hewlett Packard Enterprise (HPE)
product: Aruba ClearPass Policy Manager
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.6
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Kajetan Rostojek (@kaje11)
Published: 2024-02-27T22:06:49.616Z
CVE-2024-26301 
A vulnerability in the web-based management interface of ClearPass Policy Manager could allow a remote attacker authenticated with low privileges to access sensitive information. A successful exploit allows an attacker to retrieve information which could be used to potentially gain further access to network services supported by ClearPass Policy Manager.


Affected products: vendor: Hewlett Packard Enterprise (HPE)
product: Aruba ClearPass Policy Manager
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Niels De Carpentier
Published: 2024-02-27T22:10:54.804Z