rainbutterfly/cve_corpus huggingface dataset:
CVE-2024-9461 Total Upkeep <= 1.16.6 - Authenticated (Administrator+) Remote Code Execution via Backup Settings
The Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.16.6 via the cron_interval parameter. This is due to missing input validation and sanitization. This makes it possible for authenticated attackers, with Administrator-level access and above, to execute code on the server.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: boldgrid
product: Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
baseScore: 7.2
baseSeverity: HIGH
Credits: lang: en
value: Jonas Benjamin Friedli
Published: 2024-11-26T13:56:54.220Z
CVE-2024-9462 Poll Maker – Versus Polls, Anonymous Polls, Image Polls <= 5.4.6 - Authenticated (Administrator+) Stored Cross-Site Scripting via Poll Settings
The Poll Maker – Versus Polls, Anonymous Polls, Image Polls plugin for WordPress is vulnerable to Stored Cross-Site Scripting via poll settings in all versions up to, and including, 5.4.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: ays-pro
product: Poll Maker – Versus Polls, Anonymous Polls, Image Polls
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
baseScore: 5.5
baseSeverity: MEDIUM
Credits: lang: en
value: Jonas Benjamin Friedli
Published: 2024-10-26T01:58:37.041Z
CVE-2024-9469 Cortex XDR Agent: Local Windows User Can Disable the Agent
A problem with a detection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices enables a user with Windows non-administrative privileges to disable the agent. This issue may be leveraged by malware to disable the Cortex XDR agent and then to perform malicious activity.
Problem types: cwe_id: CWE-754
description: CWE-754: Improper Check for Unusual or Exceptional Conditions
Affected products: vendor: Palo Alto Networks
product: Cortex XDR Agent
cpes: cpe:2.3:a:paloaltonetworks:cortex_xdr_agent:8.4.0:-:*:*:*:*:*:*
cpe:2.3:a:paloaltonetworks:cortex_xdr_agent:8.3.0:-:*:*:*:*:*:*
cpe:2.3:a:paloaltonetworks:cortex_xdr_agent:7.9-CE:-:*:*:*:*:*:*
cpe:2.3:a:paloaltonetworks:cortex_xdr_agent:7.9.101-CE:-:*:*:*:*:*:*
default_status: unaffected
Credits: lang: en
value: Orange Cyberdefense Switzerland's Research Team
Published: 2024-10-09T17:05:55.091Z
CVE-2024-9470 Cortex XSOAR: Information Disclosure Vulnerability
A vulnerability in Cortex XSOAR allows the disclosure of incident data to users who do not have the privilege to view the data.
Problem types: cwe_id: CWE-497
description: CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere
Affected products: vendor: Palo Alto Networks
product: Cortex XSOAR
cpes: cpe:2.3:a:paloaltonetworks:cortex_xsoar:6.12.0:B857430:*:*:*:*:*:*
cpe:2.3:a:paloaltonetworks:cortex_xsoar:6.12.0:B661643:*:*:*:*:*:*
cpe:2.3:a:paloaltonetworks:cortex_xsoar:6.12.0:B493375:*:*:*:*:*:*
cpe:2.3:a:paloaltonetworks:cortex_xsoar:6.12.0:-:*:*:*:*:*:*
default_status: unaffected
Credits: lang: en
value: Bobby Roos of Kyndryl CSIRT
Published: 2024-10-09T17:06:13.944Z
CVE-2024-9474 PAN-OS: Privilege Escalation (PE) Vulnerability in the Web Management Interface
A privilege escalation vulnerability in Palo Alto Networks PAN-OS software allows a PAN-OS administrator with access to the management web interface to perform actions on the firewall with root privileges.

Cloud NGFW and Prisma Access are not impacted by this vulnerability.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: Palo Alto Networks
product: Cloud NGFW
default_status: unaffected
vendor: Palo Alto Networks
product: PAN-OS
default_status: unaffected
vendor: Palo Alto Networks
product: Prisma Access
default_status: unaffected
Credits: lang: en
value: Palo Alto Networks thanks our Deep Product Security Research Team for discovering this issue internally from threat activity.
Published: 2024-11-18T15:48:23.405Z
CVE-2024-9475 Poll Maker – Versus Polls, Anonymous Polls, Image Polls <= 5.4.6 - Authenticated (Administrator+) SQL Injection via Order_by Parameter
The Poll Maker – Versus Polls, Anonymous Polls, Image Polls plugin for WordPress is vulnerable to generic SQL Injection via the order_by parameter in all versions up to, and including, 5.4.6  due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with administrator-level permissions and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: ays-pro
product: Poll Maker – Versus Polls, Anonymous Polls, Image Polls
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
baseScore: 4.9
baseSeverity: MEDIUM
Credits: lang: en
value: Ivan Kuzymchak
Published: 2024-10-26T01:58:36.542Z
CVE-2024-9476 Privilege escalation vulnerability for Organizations in Grafana
A vulnerability in Grafana Labs Grafana OSS and Enterprise allows Privilege Escalation allows users to gain access to resources from other organizations within the same Grafana instance via the Grafana Cloud Migration Assistant.This vulnerability will only affect users who utilize the Organizations feature to isolate resources on their Grafana instance.
Problem types: cwe_id: CWE-266
description: CWE-266
Affected products: vendor: Grafana Labs
product: Grafana OSS and Enterprise
default_status: unaffected
Published: 2024-11-13T16:30:54.581Z
CVE-2024-9477 XSS in AirTies' Air4443 Firmware
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in AirTies Air4443 Firmware allows Cross-Site Scripting (XSS).

This issue affects Air4443 Firmware: through 14102024.




NOTE: The vendor was contacted and it was learned that the product classified as End-of-Life and End-of-Support.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: AirTies
product: Air4443 Firmware
default_status: affected
Credits: lang: en
value: Goktug KAYA
Published: 2024-11-13T14:29:40.588Z
CVE-2024-9478 
Improper Privilege Management vulnerability in upKeeper Solutions upKeeper Instant Privilege Access allows Privilege Escalation.This issue affects upKeeper Instant Privilege Access: before 1.2.
Problem types: cwe_id: CWE-266
description: CWE-266 Incorrect Privilege Assignment
Affected products: vendor: upKeeper Solutions
product: upKeeper Instant Privilege Access
default_status: unaffected
Published: 2024-11-20T13:31:33.806Z
CVE-2024-9479 
Improper Privilege Management vulnerability in upKeeper Solutions upKeeper Instant Privilege Access allows Privilege Escalation.This issue affects upKeeper Instant Privilege Access: before 1.2.
Problem types: cwe_id: CWE-266
description: CWE-266 Incorrect Privilege Assignment
Affected products: vendor: upKeeper Solutions
product: upKeeper Instant Privilege Access
default_status: unaffected
Published: 2024-11-20T13:34:36.349Z
CVE-2024-9481 Out of Bounds write on scan of malformed eml file may crash the application
An out-of-bounds write in the engine module in AVG/Avast Antivirus signature <24092400 released on 24/Sep/2024 on MacOS allows a malformed eml file to crash the application during file processing.
Problem types: cwe_id: CWE-787
description: CWE-787 Out-of-bounds Write
Affected products: vendor: AVG/Avast
product: Antivirus
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 5.1
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: Mike Zhang, an independent security researcher
Published: 2024-10-04T12:15:14.709Z
CVE-2024-9482 Out of Bounds write on scan of malformed Mach-O file may crash the application
An out-of-bounds write in the engine module in AVG/Avast Antivirus signature <24092400 released on 24/Sep/2024 on MacOS allows a malformed Mach-O file to crash the application during file processing.
Problem types: cwe_id: CWE-787
description: CWE-787 Out-of-bounds Write
Affected products: vendor: AVG/Avast
product: Antivirus
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 5.1
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: Mike Zhang, an independent security researcher
Published: 2024-10-04T12:22:47.087Z
CVE-2024-9483 Uninitialized variable in digital signiture verification may crash the application
A null-pointer-dereference in the signature verification module in AVG/Avast Antivirus signature <24092400 released on 24/Sep/2024 on MacOS may allow a malformed xar file to crash the application during processing.
Problem types: cwe_id: CWE-476
description: CWE-476 NULL Pointer Dereference
Affected products: vendor: AVG/Avast
product: Antivirus
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 5.1
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: Mike Zhang, an independent security researcher
Published: 2024-10-04T12:29:16.430Z
CVE-2024-9484 
An null-pointer-derefrence in the engine module in AVG/Avast Antivirus signature <24092400 released on 24/Sep/2024 on MacOS allows a malformed xar file to crash the application during file processing.
Problem types: cwe_id: CWE-476
description: CWE-476 NULL Pointer Dereference
Affected products: vendor: AVG/Avast
product: Antivirus
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 5.1
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: Mike Zhang, an independent security researcher
Published: 2024-10-04T12:44:25.057Z
CVE-2024-9486 VM images built with Image Builder and Proxmox provider use default credentials
A security issue was discovered in the Kubernetes Image Builder versions <= v0.1.37 where default credentials are enabled during the image build process. Virtual machine images built using the Proxmox provider do not disable these default credentials, and nodes using the resulting images may be accessible via these default credentials. The credentials can be used to gain root access. Kubernetes clusters are only affected if their nodes use VM images created via the Image Builder project with its Proxmox provider.
Problem types: cwe_id: CWE-798
description: CWE-798 Use of Hard-coded Credentials
Affected products: vendor: Kubernetes
product: Image Builder
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Credits: lang: en
value: Nicolai Rybnikar @rybnico from Rybnikar Enterprises GmbH.
Published: 2024-10-15T20:33:43.138Z
CVE-2024-9487 An Improper Verification of Cryptographic Signature vulnerability was identified in GitHub Enterprise Server that allowed SAML SSO authentication to be bypassed when the encrypted assertions feature was enabled
An improper verification of cryptographic signature vulnerability was identified in GitHub Enterprise Server that allowed SAML SSO authentication to be bypassed resulting in unauthorized provisioning of users and access to the instance. Exploitation required the encrypted assertions feature to be enabled, and the attacker would require direct network access as well as a signed SAML response or metadata document. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.15 and was fixed in versions 3.11.16, 3.12.10, 3.13.5, and 3.14.2. This vulnerability was reported via the GitHub Bug Bounty program.
Problem types: cwe_id: CWE-347
description: CWE-347 Improper Verification of Cryptographic Signature
Affected products: vendor: GitHub
product: Enterprise Server
default_status: affected
Credits: lang: en
value: SecureSAML.com
Published: 2024-10-10T21:08:48.720Z
CVE-2024-9488 Comments – wpDiscuz <= 7.6.24 - Authentication Bypass via WordPress.com OAuth provider
The Comments – wpDiscuz plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 7.6.24. This is due to insufficient verification on the user being returned by the social login token. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email and the user does not have an already-existing account for the service returning the token.
Problem types: cwe_id: CWE-288
description: CWE-288 Authentication Bypass Using an Alternate Path or Channel
Affected products: vendor: advancedcoding
product: Comments – wpDiscuz
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
baseScore: 9.8
baseSeverity: CRITICAL
Credits: lang: en
value: wesley
Published: 2024-10-25T05:35:29.077Z
CVE-2024-9490 Uncontrolled search path can lead to DLL hijacking in Silicon Labs IDE installer
DLL hijacking vulnerabilities, caused by an uncontrolled search path in Silicon Labs (8-bit) IDE installer can lead to privilege escalation and arbitrary code execution when running the impacted installer.
Problem types: cwe_id: CWE-427
description: CWE-427 Uncontrolled Search Path Element
Affected products: vendor: silabs.com
product: Silicon Labs IDE (8-bit)
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 8.6
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Thanks to Sahil Shah and Shaurya for reporting this issue.
Published: 2025-01-24T14:26:05.128Z
CVE-2024-9491 Uncontrolled search path can lead to DLL hijacking in Configuration Wizard 2 installer
DLL hijacking vulnerabilities, caused by an uncontrolled search path in Configuration Wizard 2 installer can lead to privilege escalation and arbitrary code execution when running the impacted installer.
Problem types: cwe_id: CWE-427
description: CWE-427 Uncontrolled Search Path Element
Affected products: vendor: silabs.com
product: Configuration Wizard 2
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 8.6
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Thanks to Sahil Shah and Shaurya for reporting this issue.
Published: 2025-01-24T14:26:55.677Z
CVE-2024-9492 Uncontrolled search path can lead to DLL hijacking in Flash Programming Utility installer
DLL hijacking vulnerabilities, caused by an uncontrolled search path in Flash Programming Utility installer can lead to privilege escalation and arbitrary code execution when running the impacted installer.
Problem types: cwe_id: CWE-427
description: CWE-427 Uncontrolled Search Path Element
Affected products: vendor: silabs.com
product: Flash Programming Utility
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 8.6
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Thanks to Sahil Shah and Shaurya for reporting this issue.
Published: 2025-01-24T14:27:44.846Z
CVE-2024-9493 Uncontrolled search path can lead to DLL hijacking in ToolStick installer
DLL hijacking vulnerabilities, caused by an uncontrolled search path in the 

ToolStick

 installer can lead to privilege escalation and arbitrary code execution when running the impacted installer.
Problem types: cwe_id: CWE-427
description: CWE-427 Uncontrolled Search Path Element
Affected products: vendor: silabs.com
product: ToolStick
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 8.6
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Thanks to Sahil Shah and Shaurya for reporting this issue.
Published: 2025-01-24T14:28:33.430Z
CVE-2024-9494 Uncontrolled search path can lead to DLL hijacking in CP210 VCP Win 2k installer
DLL hijacking vulnerabilities, caused by an uncontrolled search path in the 



CP210 VCP Win 2k



 installer can lead to privilege escalation and arbitrary code execution when running the impacted installer.
Problem types: cwe_id: CWE-427
description: CWE-427 Uncontrolled Search Path Element
Affected products: vendor: silabs.com
product: CP210 VCP Win 2k
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 8.6
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Thanks to Sahil Shah, Shaurya, and Ramya Shah for reporting this issue.
Published: 2025-01-24T14:37:15.436Z
CVE-2024-9495 Uncontrolled search path can lead to DLL hijacking in CP210x VCP Windows installer
DLL hijacking vulnerabilities, caused by an uncontrolled search path in the CP210x VCP Windows 



 installer can lead to privilege escalation and arbitrary code execution when running the impacted installer.
Problem types: cwe_id: CWE-427
description: CWE-427 Uncontrolled Search Path Element
Affected products: vendor: silabs.com
product: CP210x VCP Windows
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 8.6
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Thanks to Sahil Shah, Shaurya, and Vidhi Patel for reporting this issue.
Published: 2025-01-24T14:37:44.424Z
CVE-2024-9496 Uncontrolled search path can lead to DLL hijacking in USBXpress Dev Kit installer
DLL hijacking vulnerabilities, caused by an uncontrolled search path in the USBXpress Dev Kit

 



 installer can lead to privilege escalation and arbitrary code execution when running the impacted installer.
Problem types: cwe_id: CWE-427
description: CWE-427 Uncontrolled Search Path Element
Affected products: vendor: silabs.com
product: USBXpress Dev Kit
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 8.6
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Thanks to Sahil Shah and Shaurya for reporting this issue.
Published: 2025-01-24T14:38:14.189Z
CVE-2024-9497 Uncontrolled search path can lead to DLL hijacking in USBXpress 4 SDK installer
DLL hijacking vulnerabilities, caused by an uncontrolled search path in the USBXpress 4 SDK

 



 installer can lead to privilege escalation and arbitrary code execution when running the impacted installer.
Problem types: cwe_id: CWE-427
description: CWE-427 Uncontrolled Search Path Element
Affected products: vendor: silabs.com
product: USBXpress 4 SDK
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 8.6
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Thanks to Sahil Shah and Shaurya for reporting this issue.
Published: 2025-01-24T14:38:57.451Z
CVE-2024-9498 Uncontrolled search path can lead to DLL hijacking in USBXpress SDK installer
DLL hijacking vulnerabilities, caused by an uncontrolled search path in the USBXpress SDK

 



 installer can lead to privilege escalation and arbitrary code execution when running the impacted installer.
Problem types: cwe_id: CWE-427
description: CWE-427 Uncontrolled Search Path Element
Affected products: vendor: silabs.com
product: USBXpress SDK
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 8.6
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Thanks to Sahil Shah and Shaurya for reporting this issue.
Published: 2025-01-24T14:39:25.290Z
CVE-2024-9499 Uncontrolled search path can lead to DLL hijacking in USBXpress Win 98SE Dev Kit installer
DLL hijacking vulnerabilities, caused by an uncontrolled search path in the USBXpress Win 98SE Dev Kit installer can lead to privilege escalation and arbitrary code execution when running the impacted installer.
Problem types: cwe_id: CWE-427
description: CWE-427 Uncontrolled Search Path Element
Affected products: vendor: silabs.com
product: USBXpress Win 98SE Dev Kit
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 8.6
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Thanks to Sahil Shah and Shaurya for reporting this issue.
Published: 2025-01-24T14:39:51.065Z