rainbutterfly/cve_corpus huggingface dataset:
CVE-2024-28028 
Improper input validation in some Intel(R) Neural Compressor software before version v3.0 may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access.
Problem types: description: escalation of privilege
cwe_id: CWE-20
description: Improper input validation
Affected products: vendor: n/a
product: Intel(R) Neural Compressor software
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 7.5
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: ADJACENT_NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
Published: 2024-11-13T21:12:07.212Z
CVE-2024-28029 Client-Side Enforcement of Server-Side Security in Delta Electronics DIAEnergie
Privileges are not fully verified server-side, which can be abused by a user with limited privileges to bypass authorization and access privileged functionality.
Problem types: cwe_id: CWE-602
description: CWE-602 Client-Side Enforcement of Server-Side Security
Affected products: vendor: Delta Electronics
product: DIAEnergie
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Michael Heinzl reported these vulnerabilities to CISA.
Published: 2024-03-21T22:04:57.512Z
CVE-2024-28030 
NULL pointer dereference in some Intel(R) VPL software before version 24.1.4 may allow an authenticated user to potentially enable denial of service via local access.
Problem types: description: denial of service
cwe_id: CWE-395
description: NULL pointer dereference
Affected products: vendor: n/a
product: Intel(R) VPL software
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 2.2
baseSeverity: LOW
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: LOW
Published: 2024-11-13T21:05:56.770Z
CVE-2024-28033 
OS command injection vulnerability exists in WebProxy 1.7.8 and 1.7.9, which may allow a remote unauthenticated attacker to execute an arbitrary OS command with the privilege of the running web server. Note that the developer was unreachable, therefore, users should consider stop using WebProxy 1.7.8 and 1.7.9.
Problem types: description: OS command injection
Affected products: vendor: LunarNight Laboratory
product: WebProxy
vendor: LunarNight Laboratory
product: WebProxy
Published: 2024-03-26T09:34:07.760Z
CVE-2024-28034 
Cross-site scripting vulnerability exists in Mini Thread Version 3.33βi. An arbitrary script may be executed on the web browser of the user accessing the website that uses the product. Note that the developer was unreachable, therefore, users should consider stop using Mini Thread Version 3.33βi.
Problem types: description: Cross-site scripting (XSS)
Affected products: vendor: Flash CGI
product: Mini Thread
Published: 2024-03-26T09:36:04.246Z
CVE-2024-28036 
Improper conditions check for some Intel(R) Arc™ GPU may allow an authenticated user to potentially enable denial of service via local access.
Problem types: description: Denial of Service
cwe_id: CWE-754
description: Improper Check for Unusual or Exceptional Conditions
Affected products: vendor: n/a
product: Intel(R) Arc™ GPU
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 5.6
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: NONE
scope: CHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
Published: 2025-05-13T21:02:53.126Z
CVE-2024-28038 
The web interface of the affected devices processes a cookie value improperly, leading to a stack buffer overflow. More precisely, giving too long character string to MFPSESSIONID parameter results in a stack buffer overflow. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References].
Problem types: cwe_id: CWE-121
description: Stack-based buffer overflow
Affected products: vendor: Sharp Corporation
product: Multiple MFPs (multifunction printers)
vendor: Toshiba Tec Corporation
product: Multiple MFPs (multifunction printers)
CVSS v3.1: version: 3.1
baseSeverity: CRITICAL
baseScore: 9
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Published: 2024-11-26T07:37:06.324Z
CVE-2024-28039 
Improper restriction of XML external entity references vulnerability exists in FitNesse all releases, which allows a remote unauthenticated attacker to obtain sensitive information, alter data, or cause a denial-of-service (DoS) condition.
Problem types: description: XML external entities (XXE)
Affected products: vendor: unclebob
product: FitNesse
Published: 2024-03-18T08:13:26.248Z
CVE-2024-28040 Delta Electronics DIAEnergie SQL injection

SQL injection vulnerability exists in GetDIAE_astListParameters.


Problem types: cwe_id: CWE-89
description: CWE-89 Improper neutralization of special elements used in an SQL command ('SQL injection') 
Affected products: vendor: Delta Electronics
product: DIAEnergie
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Michael Heinzl reported these vulnerabilities to CISA.
Published: 2024-03-21T22:13:40.119Z
CVE-2024-28041 
HGW BL1500HM Ver 002.001.013 and earlier allows a network-adjacent unauthenticated attacker to execute an arbitrary command.
Problem types: description: Arbitrary command execution
Affected products: vendor: KDDI CORPORATION
product: HGW BL1500HM
Published: 2024-03-25T03:42:17.754Z
CVE-2024-28042 SUBNET PowerSYSTEM Center Reliance on Insufficiently Trustworthy Component
SUBNET Solutions Inc. has identified vulnerabilities in third-party components used in PowerSYSTEM Center.
Problem types: cwe_id: CWE-1357
description: CWE-1357
Affected products: vendor: SUBNET
product: PowerSYSTEM Center
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 8.4
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: SUBNET Solutions reported these vulnerabilities to CISA.
Published: 2024-05-15T16:44:19.227Z
CVE-2024-28044 Liteos-A has an integer  overflow vulnerability
in OpenHarmony v4.1.0 and prior versions allow a local attacker cause crash through integer overflow.
Problem types: cwe_id: CWE-190
description: CWE-190 Integer Overflow or Wraparound
Affected products: vendor: OpenHarmony
product: OpenHarmony
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 3.3
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
version: 3.1
Published: 2024-09-02T03:24:52.604Z
CVE-2024-28045 Delta Electronics DIAEnergie Cross-site scripting

Improper neutralization of input within the affected product could lead to cross-site scripting.


Problem types: cwe_id: CWE-79
description: CWE-79: Improper neutralization of input during web page generation ('Cross-site scripting')
Affected products: vendor: Delta Electronics
product: DIAEnergie
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.6
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: Michael Heinzl reported these vulnerabilities to CISA.
Published: 2024-03-21T22:24:12.286Z
CVE-2024-28046 
Uncontrolled search path in some Intel(R) GPA software before version 2024.1 may allow an authenticated user to potentially enable escalation of privilege via local access.
Problem types: description: escalation of privilege
cwe_id: CWE-427
description: Uncontrolled search path
Affected products: vendor: n/a
product: Intel(R) GPA software
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 6.7
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
Published: 2024-08-14T13:45:26.495Z
CVE-2024-28047 
Improper input validation in UEFI firmware for some Intel(R) Processors may allow a privileged user to potentially enable information disclosure via local access.
Problem types: description: Information Disclosure
cwe_id: CWE-20
description: Improper Input Validation
Affected products: vendor: n/a
product: Intel(R) Processors
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 5.3
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: HIGH
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
Published: 2025-02-12T21:19:36.237Z
CVE-2024-28048 
OS command injection vulnerability exists in ffBull ver.4.11, which may allow a remote unauthenticated attacker to execute an arbitrary OS command with the privilege of the running web server. Note that the developer was unreachable, therefore, users should consider stop using ffBull ver.4.11.
Problem types: description: OS command injection
Affected products: vendor: Fortunefield
product: ffBull
Published: 2024-03-26T09:37:32.711Z
CVE-2024-28049 
Improper input validation in firmware for some Intel(R) PROSet/Wireless Software and Intel(R) Killer(TM) Wi-Fi wireless products before version 23.40 may allow an unauthenticated user to enable denial of service via adjacent access.
Problem types: description: denial of service
cwe_id: CWE-20
description: Improper input validation
Affected products: vendor: n/a
product: Intel(R) PROSet/Wireless Software and Intel(R) Killer(TM) Wi-Fi wireless products
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 5.7
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
attackVector: ADJACENT_NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
Published: 2024-11-13T20:36:12.489Z
CVE-2024-28050 
Improper access control in some Intel(R) Arc(TM) & Iris(R) Xe Graphics software before version 31.0.101.4824 may allow an authenticated user to potentially enable denial of service via local access.
Problem types: description: denial of service
cwe_id: CWE-284
description: Improper access control
Affected products: vendor: n/a
product: Intel(R) Arc(TM) & Iris(R) Xe Graphics software
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 5
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
Published: 2024-08-14T13:45:16.572Z
CVE-2024-28051 
Out-of-bounds read in some Intel(R) VPL software before version 24.1.4 may allow an authenticated user to potentially enable information disclosure via local access.
Problem types: description: information disclosure
cwe_id: CWE-125
description: Out-of-bounds read
Affected products: vendor: n/a
product: Intel(R) VPL software
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 2.2
baseSeverity: LOW
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
Published: 2024-11-13T21:04:10.094Z
CVE-2024-28052 
The WBR-6012 is a wireless SOHO router. It is a low-cost device which functions as an internet gateway for homes and small offices while aiming to be easy to configure and operate. In addition to providing a WiFi access point, the device serves as a 4-port wired router and implements a variety of common SOHO router capabilities such as port forwarding, quality-of-service, web-based administration, a DHCP server, a basic DMZ, and UPnP capabilities.
Problem types: cwe_id: CWE-131
description: CWE-131: Incorrect Calculation of Buffer Size
Affected products: vendor: LevelOne
product: WBR-6012
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: LOW
baseScore: 5.3
baseSeverity: MEDIUM
Credits: lang: en
value: Discovered by Patrick DeSantis and Francesco Benvenuto of Cisco Talos.
Published: 2024-10-30T13:35:14.618Z
CVE-2024-28053 Resource Exhaustion via the Invitation Feature
Resource Exhaustion in Mattermost Server versions 8.1.x before 8.1.10 fails to limit the size of the payload that can be read and parsed allowing an attacker to send a very large email payload and crash the server.


Problem types: cwe_id: CWE-400
description: CWE-400: Uncontrolled Resource Consumption
Affected products: vendor: Mattermost
product: Mattermost
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 3.1
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
version: 3.1
Credits: lang: en
value: . (themarkib0x0)
Published: 2024-03-15T09:08:04.993Z
CVE-2024-28054 
Amavis before 2.12.3 and 2.13.x before 2.13.1, in part because of its use of MIME-tools, has an Interpretation Conflict (relative to some mail user agents) when there are multiple boundary parameters in a MIME email message. Consequently, there can be an incorrect check for banned files or malware.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-18T00:00:00.000Z
CVE-2024-28056 
Amazon AWS Amplify CLI before 12.10.1 incorrectly configures the role trust policy of IAM roles associated with Amplify projects. When the Authentication component is removed from an Amplify project, a Condition property is removed but "Effect":"Allow" remains present, and consequently sts:AssumeRoleWithWebIdentity would be available to threat actors with no conditions. Thus, if Amplify CLI had been used to remove the Authentication component from a project built between August 2019 and January 2024, an "assume role" may have occurred, and may have been leveraged to obtain unauthorized access to an organization's AWS resources. NOTE: the problem could only occur if an authorized AWS user removed an Authentication component. (The vulnerability did not give a threat actor the ability to remove an Authentication component.) However, in realistic situations, an authorized AWS user may have removed an Authentication component, e.g., if the objective were to stop using built-in Cognito resources, or move to a completely different identity provider.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-15T00:00:00.000Z
CVE-2024-28058 
In RSA NetWitness (NW) Platform before 12.5.1, even when an administrator revokes the access of a specific user with an active session, an internal threat actor could impersonate the revoked user and gain unauthorized access to sensitive data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-18T00:00:00.000Z
CVE-2024-28060 
An issue was discovered in Apiris Kafeo 6.4.4. It permits DLL hijacking, allowing a user to trigger the execution of arbitrary code every time the product is executed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-28T19:56:27.110Z
CVE-2024-28061 
An issue was discovered in Apiris Kafeo 6.4.4. It permits a bypass, of the protection in place, to access to the data stored in the embedded database file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-28T19:35:35.950Z
CVE-2024-28063 
Kiteworks Totemomail through 7.0.0 allows /responsiveUI/EnvelopeOpenServlet envelopeRecipient reflected XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-18T21:55:53.867Z
CVE-2024-28064 
Kiteworks Totemomail 7.x and 8.x before 8.3.0 allows /responsiveUI/EnvelopeOpenServlet messageId directory traversal for unauthenticated file read and delete operations (with displayLoginChunkedImages) and write operations (with storeLoginChunkedImages).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-18T22:02:03.643Z
CVE-2024-28065 
In Unify CP IP Phone firmware 1.10.4.3, files are not encrypted and contain sensitive information such as the root password hash.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-05T00:00:00.000Z
CVE-2024-28066 
In Unify CP IP Phone firmware 1.10.4.3, Weak Credentials are used (a hardcoded root password).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-08T00:00:00.000Z
CVE-2024-28067 
A vulnerability in Samsung Exynos Modem 5300 allows a Man-in-the-Middle (MITM) attacker to downgrade the security mode of packets going to the victim, enabling the attacker to send messages to the victim in plaintext.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AC:H/AV:A/A:N/C:N/I:H/PR:N/S:U/UI:N
attackVector: ADJACENT_NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: HIGH
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
Published: 2024-07-09T00:00:00.000Z
CVE-2024-28068 
A vulnerability was discovered in SS in Samsung Mobile Processor, Wearable Processor, and Modems with versions Exynos 9820, Exynos 9825, Exynos 980, Exynos 990, Exynos 850, Exynos 1080, Exynos 2100, Exynos 2200, Exynos 1280, Exynos 1380, Exynos 1330, Exynos 2400, Exynos 9110, Exynos W920, Exynos W930, Exynos Modem 5123, and Exynos Modem 5300 that involves a NULL pointer dereference which can cause abnormal termination of a mobile phone via a manipulated packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AC:H/AV:A/A:H/C:N/I:N/PR:N/S:U/UI:N
attackVector: ADJACENT_NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
baseScore: 5.3
baseSeverity: MEDIUM
Published: 2024-07-09T00:00:00.000Z
CVE-2024-28069 
A vulnerability in the legacy chat component of Mitel MiContact Center Business through 10.0.0.4 could allow an unauthenticated attacker to conduct an information disclosure attack due to improper configuration. A successful exploit could allow an attacker to access sensitive information and potentially conduct unauthorized actions within the vulnerable component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-16T00:00:00.000Z
CVE-2024-28070 
A vulnerability in the legacy chat component of Mitel MiContact Center Business through 10.0.0.4 could allow an unauthenticated attacker to conduct a reflected cross-site scripting (XSS) attack due to insufficient input validation. A successful exploit could allow an attacker to access sensitive information and gain unauthorized access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-16T00:00:00.000Z
CVE-2024-28072 Arbitrary File Overwrite Vulnerability
A highly privileged account can overwrite arbitrary files on the system with log output. The log file path tags were not sanitized properly. 







Problem types: cwe_id: CWE-532
description: CWE-532 Insertion of Sensitive Information into Log File
Affected products: vendor: SolarWinds 
product: Serv-U
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: LOW
baseScore: 5.7
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:L
version: 3.1
Credits: lang: en
value: Alexander Skovsende at the Institute for Cyber Risk
Published: 2024-05-03T07:50:00.696Z
CVE-2024-28073 SolarWinds Serv-U Directory Traversal Remote Code Execution Vulnerability 
SolarWinds Serv-U was found to be susceptible to a Directory Traversal Remote Code Vulnerability. This vulnerability requires a highly privileged account to be exploited.

Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: SolarWinds
product: ServU
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.4
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Alexander Skovsende at the Institut For Cyber Risk
Published: 2024-04-17T16:58:12.353Z
CVE-2024-28074 SolarWinds Access Rights Manager (ARM) Internal Deserialization Remote Code Execution Vulnerability 
It was discovered that a previous vulnerability was not completely fixed with SolarWinds Access Rights Manager. While some controls were implemented the researcher was able to bypass these and use a different method to exploit the vulnerability.
Problem types: cwe_id: CWE-502
description: CWE-502 Deserialization of Untrusted Data
Affected products: vendor: SolarWinds
product: Access Rights Manager
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 9.6
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Anonymous working with Trend Micro Zero Day Initiative
Published: 2024-07-17T14:29:39.778Z