rainbutterfly/cve_corpus huggingface dataset:
CVE-2024-41884 Null Pointer Dereference
Team ENVY, a Security Research TEAM has found a flaw that allows for a remote code execution on the NVR. If an attacker does not enter any value for a specific URL parameter, NULL pointer references will occur and the NVR will reboot. The manufacturer has released patch firmware for the flaw, please refer to the manufacturer's report for details and workarounds.
Problem types: cwe_id: CWE-476
description: CWE-476 NULL Pointer Dereference
Affected products: vendor: Hanwha Vision Co., Ltd.
product: XRN-420S
default_status: unaffected
Published: 2024-12-24T05:30:41.603Z
CVE-2024-41885 Hardcoding sensitive information
Team ENVY, a Security Research TEAM has found a flaw that allows for a remote code execution on the NVR. The seed string for the encrypt key was hardcoding. The manufacturer has released patch firmware for the flaw, please refer to the manufacturer's report for details and workarounds.
Problem types: cwe_id: CWE-547
description: CWE-547 Use of Hard-coded, Security-relevant Constants
Affected products: vendor: Hanwha Vision Co., Ltd.
product: XRN-420S
default_status: unaffected
Published: 2024-12-24T05:27:39.718Z
CVE-2024-41886 Improper Input Validation
Team ENVY, a Security Research TEAM has found a flaw that allows for a remote code execution on the NVR. An attacker could inject malformed data into url input parameters to reboot the NVR. The manufacturer has released patch firmware for the flaw, please refer to the manufacturer's report for details and workarounds.
Problem types: cwe_id: CWE-755
description: CWE-755 Improper Handling of Exceptional Conditions
Affected products: vendor: Hanwha Vision Co., Ltd.
product: XRN-420S
default_status: unaffected
Published: 2024-12-24T05:23:52.078Z
CVE-2024-41887 Arbitrary File Overwrite
Team ENVY, a Security Research TEAM has found a flaw that allows for a remote code execution on the NVR. An attacker can create an NVR log file in a directory one level higher on the system, which can be used to corrupt files in the directory. The manufacturer has released patch firmware for the flaw, please refer to the manufacturer's report for details and workarounds.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Hanwha Vision Co., Ltd.
product: XRN-420S
default_status: unaffected
Published: 2024-12-24T05:20:40.653Z
CVE-2024-41888 Apache Answer: The link for resetting user password is not Single-Use
Missing Release of Resource after Effective Lifetime vulnerability in Apache Answer.

This issue affects Apache Answer: through 1.3.5.

The password reset link remains valid within its expiration period even after it has been used. This could potentially lead to the link being misused or hijacked.
Users are recommended to upgrade to version 1.3.6, which fixes the issue.
Problem types: cwe_id: CWE-772
description: CWE-772 Missing Release of Resource after Effective Lifetime
Affected products: vendor: Apache Software Foundation
product: Apache Answer
default_status: unaffected
Credits: lang: en
value: Mohammad Reza Omrani
Published: 2024-08-09T14:55:14.493Z
CVE-2024-41889 
Multiple Pimax products accept WebSocket connections from unintended endpoints. If this vulnerability is exploited, arbitrary code may be executed by a remote unauthenticated attacker.
Problem types: description: Improper restriction of communication channel to intended endpoints
Affected products: vendor: Pimax
product: Pimax Play
vendor: Pimax
product: PiTool
Published: 2024-08-05T04:36:27.107Z
CVE-2024-41890 Apache Answer: The link to reset the user's password will remain valid after sending a new link
Missing Release of Resource after Effective Lifetime vulnerability in Apache Answer.

This issue affects Apache Answer: through 1.3.5.

User sends multiple password reset emails, each containing a valid link. Within the link's validity period, this could potentially lead to the link being misused or hijacked.
Users are recommended to upgrade to version 1.3.6, which fixes the issue.
Problem types: cwe_id: CWE-772
description: CWE-772 Missing Release of Resource after Effective Lifetime
Affected products: vendor: Apache Software Foundation
product: Apache Answer
default_status: unaffected
Credits: lang: en
value: Mohammad Reza Omrani
Published: 2024-08-09T14:53:28.544Z
CVE-2024-41902 
A vulnerability has been identified in JT2Go (All versions < V2406.0003). The affected application contains a stack-based buffer overflow vulnerability that could be triggered while parsing specially crafted PDF files. This could allow an attacker to execute code in the context of the current process.
Problem types: cwe_id: CWE-121
description: CWE-121: Stack-based Buffer Overflow
Affected products: vendor: Siemens
product: JT2Go
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
baseScore: 7.8
baseSeverity: HIGH
Published: 2024-10-08T08:40:18.170Z
CVE-2024-41903 
A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V2.0). The affected application mounts the container's root filesystem with read and write privileges. This could allow an attacker to alter the container's filesystem leading to unauthorized modifications and data corruption.
Problem types: cwe_id: CWE-269
description: CWE-269: Improper Privilege Management
Affected products: vendor: Siemens
product: SINEC Traffic Analyzer
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
baseScore: 6.6
baseSeverity: MEDIUM
Published: 2024-08-13T07:54:22.465Z
CVE-2024-41904 
A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V2.0). The affected application do not properly enforce restriction of  excessive authentication attempts. This could allow an unauthenticated attacker to conduct brute force attacks against legitimate user credentials or keys.
Problem types: cwe_id: CWE-307
description: CWE-307: Improper Restriction of Excessive Authentication Attempts
Affected products: vendor: Siemens
product: SINEC Traffic Analyzer
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
baseScore: 7.5
baseSeverity: HIGH
Published: 2024-08-13T07:54:23.788Z
CVE-2024-41905 
A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V2.0). The affected application do not have access control for accessing the files. This could allow an authenticated attacker with low privilege's to get access to sensitive information.
Problem types: cwe_id: CWE-284
description: CWE-284: Improper Access Control
Affected products: vendor: Siemens
product: SINEC Traffic Analyzer
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
baseScore: 6.8
baseSeverity: MEDIUM
Published: 2024-08-13T07:54:25.056Z
CVE-2024-41906 
A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V2.0). The affected application does not properly handle cacheable HTTP responses in the web service. This could allow an attacker to read and modify data stored in the local cache.
Problem types: cwe_id: CWE-524
description: CWE-524: Use of Cache Containing Sensitive Information
Affected products: vendor: Siemens
product: SINEC Traffic Analyzer
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
baseScore: 4.8
baseSeverity: MEDIUM
Published: 2024-08-13T07:54:26.385Z
CVE-2024-41907 
A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V2.0). The affected application is missing general HTTP security headers in the web server. This could allow an attacker to make the servers more prone to clickjacking attack.
Problem types: cwe_id: CWE-358
description: CWE-358: Improperly Implemented Security Check for Standard
Affected products: vendor: Siemens
product: SINEC Traffic Analyzer
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
baseScore: 4.2
baseSeverity: MEDIUM
Published: 2024-08-13T07:54:27.688Z
CVE-2024-41908 
A vulnerability has been identified in NX (All versions < V2406.3000). The affected applications contains an out of bounds read vulnerability while parsing specially crafted PRT files. This could allow an attacker to crash the application or execute code in the context of the current process.
Problem types: cwe_id: CWE-125
description: CWE-125: Out-of-bounds Read
Affected products: vendor: Siemens
product: NX
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
baseScore: 7.8
baseSeverity: HIGH
Published: 2024-08-13T07:54:28.985Z
CVE-2024-41909 Apache MINA SSHD: integrity check bypass
Like many other SSH implementations, Apache MINA SSHD suffered from the issue that is more widely known as CVE-2023-48795. An attacker that can intercept traffic between client and server could drop certain packets from the stream, potentially causing client and server to consequently end up with a connection for which 
some security features have been downgraded or disabled, aka a Terrapin 
attack

The mitigations to prevent this type of attack were implemented in Apache MINA SSHD 2.12.0, both client and server side. Users are recommended to upgrade to at least this version. Note that both the client and the server implementation must have mitigations applied against this issue, otherwise the connection may still be affected.
Problem types: cwe_id: CWE-354
description: CWE-354 Improper Validation of Integrity Check Value
Affected products: vendor: Apache Software Foundation
product: Apache MINA SSHD
default_status: unaffected
Credits: lang: en
value: Fabian Bäumer
Published: 2024-08-12T16:00:29.568Z
CVE-2024-41910 
A vulnerability was discovered in the firmware builds up to 10.10.2.2 in Poly Clariti Manager devices.  The firmware contained multiple XSS vulnerabilities in the version of JavaScript used.
Affected products: vendor: HP Inc.
product: Poly Clariti Manager
Published: 2024-08-06T14:05:28.473Z
CVE-2024-41911 
A vulnerability was discovered in the firmware builds up to 10.10.2.2 in Poly Clariti Manager devices. The flaw does not properly neutralize input during a web page generation.
Affected products: vendor: HP Inc.
product: Poly Clariti Manager
Published: 2024-08-06T14:07:33.637Z
CVE-2024-41912 
A vulnerability was discovered in the firmware builds up to 10.10.2.2 in Poly Clariti Manager devices. The firmware flaw does not properly implement access controls.
Affected products: vendor: HP Inc.
product: Poly Clariti Manager
Published: 2024-08-07T19:54:47.266Z
CVE-2024-41913 Clariti Manager – Arbitrary File Upload
A vulnerability was discovered in the firmware builds up to 10.10.2.2 in Poly Clariti Manager devices.  The firmware flaw does not properly sanitize User input.
Affected products: vendor: HP Inc.
product: Poly Clariti Manager
Published: 2024-08-06T13:57:29.551Z
CVE-2024-41914 
A vulnerability in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS) attack against an administrative user of the interface. A successful exploit allows an attacker to execute arbitrary script code in a victim's browser in the context of the affected interface.
Affected products: vendor: Hewlett Packard Enterprise
product: HPE Aruba Networking EdgeConnect SD-WAN Orchestrator
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N
version: 3.1
Credits: lang: en
value: Daniel Jensen (@dozernz)
Published: 2024-07-24T14:57:55.556Z
CVE-2024-41915 Authenticated SQL Injection Vulnerability in ClearPass Policy Manager Web-based Management Interface
A vulnerability in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct SQL injection attacks against the ClearPass Policy Manager instance. An attacker could exploit this vulnerability to obtain and modify sensitive information in the underlying database potentially leading to complete compromise of the ClearPass Policy Manager cluster.
Affected products: vendor: Hewlett Packard Enterprise (HPE)
product: ClearPass Policy Manager (CPPM)
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: security team at Cabridge University [CN2][GN3]
Published: 2024-07-30T17:07:42.565Z
CVE-2024-41916 Authenticated Sensitive Information Disclosure in ClearPass Policy Manager
A vulnerability exists in ClearPass Policy Manager that allows for an attacker with administrative privileges to access sensitive information in a cleartext format. A successful exploit allows an attacker to retrieve information which could be used to potentially gain further access to network services supported by ClearPass Policy Manager.
Affected products: vendor: Hewlett Packard Enterprise (HPE)
product: ClearPass Policy Manager (CPPM)
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.8
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Security Team at Quinstreet Inc.
Published: 2024-07-30T17:09:40.673Z
CVE-2024-41917 
Time-of-check time-of-use race condition for some Intel(R) Battery Life Diagnostic Tool software before version 2.4.1 may allow an authenticated user to potentially enable escalation of privilege via local access.
Problem types: description: Escalation of Privilege
cwe_id: CWE-367
description: Time-of-check Time-of-use (TOCTOU) Race Condition
Affected products: vendor: n/a
product: Intel(R) Battery Life Diagnostic Tool software
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 7.5
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
Published: 2025-02-12T21:19:00.939Z
CVE-2024-41918 
'Rakuten Ichiba App' for Android 12.4.0 and earlier and 'Rakuten Ichiba App' for iOS 11.7.0 and earlier are vulnerable to improper authorization in handler for custom URL scheme. An arbitrary site may be displayed on the WebView of the product via Intent from another application installed on the user's device. As a result, the user may be redirected to an unauthorized site, and the user may become a victim of a phishing attack.
Problem types: description: Improper authorization in handler for custom URL scheme
Affected products: vendor: Rakuten Group, Inc.
product: 'Rakuten Ichiba App' for Android
vendor: Rakuten Group, Inc.
product: 'Rakuten Ichiba App' for iOS
Published: 2024-08-29T02:47:19.480Z
CVE-2024-41921 Unsafe use of eval() method in rostopic echo tool
A code injection vulnerability has been discovered in the Robot Operating System (ROS) 'rostopic' command-line tool, affecting ROS distributions Noetic Ninjemys and earlier. The vulnerability lies in the 'echo' verb, which allows a user to introspect a ROS topic and accepts a user-provided Python expression via the --filter option. This input is passed directly to the eval() function without sanitization, allowing a local user to craft and execute arbitrary code.
Problem types: cwe_id: CWE-95
description: CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
cwe_id: CWE-94
description: CWE-94: Improper Control of Generation of Code ('Code Injection')
Affected products: vendor: Open Source Robotics Foundation
product: Robot Operating System (ROS)
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Florencia Cabral Berenfus, Ubuntu Robotics Team
Published: 2025-07-17T19:13:34.025Z
CVE-2024-41922 
A directory traversal vulnerability exists in the log files download functionality of Veertu Anka Build 1.42.0. A specially crafted HTTP request can lead to a disclosure of sensitive information. An attacker can make an unauthenticated HTTP request to trigger this vulnerability.
Problem types: cwe_id: CWE-22
description: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Veertu
product: Anka Build
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
Credits: lang: en
value: Discovered by KPC of Cisco Talos.
Published: 2024-10-03T15:16:09.668Z
CVE-2024-41924 
Acceptance of extraneous untrusted data with trusted data vulnerability exists in EC-CUBE 4 series. If this vulnerability is exploited, an attacker who obtained the administrative privilege may install an arbitrary PHP package. If the obsolete versions of PHP packages are installed, the product may be affected by some known vulnerabilities.
Problem types: description: Acceptance of extraneous untrusted data with trusted data
Affected products: vendor: EC-CUBE CO.,LTD.
product: EC-CUBE 4 series
Published: 2024-07-30T08:45:48.496Z
CVE-2024-41925 Optigo Networks ONS-S8 Spectra Aggregation Switch PHP Remote File Inclusion
The web service for ONS-S8 - Spectra Aggregation Switch includes functions which do not properly validate user input, allowing an attacker to traverse directories, bypass authentication, and execute remote code.
Problem types: cwe_id: CWE-98
description: CWE-98
Affected products: vendor: Optigo Networks
product: ONS-S8 Spectra Aggregation Switch
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Claroty Team82 reported this vulnerability to CISA.
Published: 2024-10-03T22:17:31.725Z
CVE-2024-41926 Malicious remote can claim that a user was synced from another remote
Mattermost versions 9.9.x <= 9.9.0 and 9.5.x <= 9.5.6 fail to validate the source of sync messages and only allow the correct remote IDs, which allows a malicious remote to set arbitrary RemoteId values for synced users and therefore claim that a user was synced from another remote.
Problem types: cwe_id: CWE-284
description: CWE-284: Improper Access Control
Affected products: vendor: Mattermost
product: Mattermost
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 2.7
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: Juho Forsén
Published: 2024-08-01T14:05:10.650Z
CVE-2024-41927 
Cleartext transmission of sensitive information vulnerability exists in multiple IDEC PLCs. If an attacker sends a specific command to PLC's serial communication port, user credentials may be obtained. As a result, the program of the PLC may be obtained, and the PLC may be manipulated.
Problem types: cwe_id: CWE-319
description: Cleartext transmission of sensitive information
Affected products: vendor: IDEC Corporation
product: FC6A Series MICROSmart All-in-One CPU module
vendor: IDEC Corporation
product: FC6B Series MICROSmart All-in-One CPU module
vendor: IDEC Corporation
product: FC6A Series MICROSmart Plus CPU module
vendor: IDEC Corporation
product: FC6B Series MICROSmart Plus CPU module
vendor: IDEC Corporation
product: FT1A Series SmartAXIS Pro/Lite
Published: 2024-09-04T00:43:55.555Z
CVE-2024-41928 bhyve(8) privileged guest escape via TPM device passthrough
Malicious software running in a guest VM can exploit the buffer overflow to achieve code execution on the host in the bhyve userspace process, which typically runs as root. Note that bhyve runs in a Capsicum sandbox, so malicious code is constrained by the capabilities available to the bhyve process.
Problem types: cwe_id: CWE-125
description: CWE-125 Out-of-bounds Read
cwe_id: CWE-787
description: CWE-787 Out-of-bounds Write
cwe_id: CWE-1285
description: CWE-1285 Improper Validation of Specified Index, Position, or Offset in Input
Affected products: vendor: FreeBSD
product: FreeBSD
default_status: unknown
Credits: lang: en
value: Synacktiv
lang: en
value: The FreeBSD Foundation
lang: en
value: The Alpha-Omega Project
Published: 2024-09-05T03:32:56.561Z
CVE-2024-41929 
Improper authentication vulnerability in multiple digital video recorders provided by TAKENAKA ENGINEERING CO., LTD. allows a remote authenticated attacker to execute an arbitrary OS command on the device or alter the device settings.
Problem types: description: Improper authentication
Affected products: vendor: TAKENAKA ENGINEERING CO., LTD.
product: HDVR-400
vendor: TAKENAKA ENGINEERING CO., LTD.
product: HDVR-800
vendor: TAKENAKA ENGINEERING CO., LTD.
product: HDVR-1600
vendor: TAKENAKA ENGINEERING CO., LTD.
product: AHD04T-A
vendor: TAKENAKA ENGINEERING CO., LTD.
product: AHD08T-A
vendor: TAKENAKA ENGINEERING CO., LTD.
product: AHD16T-A
vendor: TAKENAKA ENGINEERING CO., LTD.
product: NVR04T-A
vendor: TAKENAKA ENGINEERING CO., LTD.
product: NVR08T-A
vendor: TAKENAKA ENGINEERING CO., LTD.
product: NVR16T-A
Published: 2024-09-18T06:07:55.880Z
CVE-2024-41930 
Cross-site scripting vulnerability exists in MF Teacher Performance Management System version 6. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the website using the product.
Problem types: cwe_id: CWE-79
description: Cross-site scripting (XSS)
Affected products: vendor: Media Fusion Co.,Ltd.
product: MF Teacher Performance Management System
Published: 2024-09-27T08:55:36.791Z
CVE-2024-41931 goTenna Pro ATAK Plugin Insertion of Sensitive Information Into Sent Data
The goTenna Pro ATAK Plugin encryption key name is always sent 
unencrypted when the key is sent over RF through a broadcast message. It
 is advised to share the encryption key via local QR for higher security
 operations.
Problem types: cwe_id: CWE-201
description: CWE-201
Affected products: vendor: goTenna
product: Pro ATAK Plugin
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: Erwin Karincic, Clayton Smith, and Dale Wooden reported this these vulnerabilities to CISA.
Published: 2024-09-26T17:42:16.640Z